MCP Tools Reference: chronicle.googleapis.com

Tool: get_feed

Get detailed information about a specific feed.

Retrieves complete configuration details for a specified feed by its ID, including connection settings, log type, state, and metadata.

Workflow Integration: - Use to inspect the configuration of a specific feed. - Essential for troubleshooting feed issues or verifying settings.

Use Cases: - Check the detailed configuration of a failing feed. - Verify the source settings for a specific log type.

Args: feed_id (str): The unique ID of the feed (e.g., "feed_12345"). project_id (str): Google Cloud project ID (required). customer_id (str): Chronicle customer ID (required). region (str): Chronicle region (e.g., "us", "europe") (required).

Returns: str: Raw JSON response containing the feed details.

Example Usage: get_feed( feed_id="feed_12345", project_id="my-project", customer_id="my-customer", region="us" )

The following sample demonstrate how to use curl to invoke the get_feed MCP tool.

Curl Request 
                  
curl --location 'https://chronicle.googleapis.com/mcp' \
--header 'content-type: application/json' \
--header 'accept: application/json, text/event-stream' \
--data '{
  "method": "tools/call",
  "params": {
    "name": "get_feed",
    "arguments": {
      // provide these details according to the tool's MCP specification
    }
  },
  "jsonrpc": "2.0",
  "id": 1
}'

Input Schema

Request message for GetFeed.

GetFeedRequest

JSON representation 
{
  "projectId": string,
  "customerId": string,
  "region": string,
  "feedId": string
}
Fields
projectId

string

Project ID of the customer.
customerId

string

Customer ID of the customer.
region

string

Region of the customer.
feedId

string

The unique ID of the feed.

Output Schema

Feed is a resource that contains feed information needed to create a feed.

Feed

JSON representation 
{
  "name": string,
  "uid": string,
  "displayName": string,
  "details": {
    object (FeedDetails)
  },
  "state": enum (State),
  "failureMsg": string,
  "readOnly": boolean,
  "lastFeedInitiationTime": string,
  "failureDetails": {
    object (FeedFailureDetails)
  },
  "referenceId": string
}
Fields
name

string

The resource name of the feed. Format: projects/{project}/locations/{location}/instances/{instance}/feeds/{feed}
uid

string

Output only. Unique identifier for the feed.
displayName

string

Customer-provided feed name.
details

object (FeedDetails)

Additional details of the feed, these details are dynamic and will be different for each of the feeds.
state

enum (State)

Output only. State of the feed.
failureMsg

string

Output only. Details about the most recent failure when feed state is FAILED.
readOnly

boolean

Output only. Whether this feed can be updated or deleted.
lastFeedInitiationTime

string (Timestamp format)

Output only. Latest timestamp when the transfer was successful for the feed.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
failureDetails

object (FeedFailureDetails)

Output only. Failure details for the feed. If the feed is in the failure state, this field will contain the details of the error cause and actions.
referenceId

string

Output only. Reference ID, this field will contain the legacy id of the feed.

FeedDetails

JSON representation 
{
  "feedSourceType": enum (FeedSourceType),
  "logType": string,
  "assetNamespace": string,
  "labels": {
    string: string,
    ...
  },
  "stsMigrationReadiness": enum (STSMigrationReadiness),

  // Union field details can be only one of the following:
  "anomaliSettings": {
    object (AnomaliIocSettings)
  },
  "azureAdContextSettings": {
    object (AzureADContextSettings)
  },
  "cloudPassageSettings": {
    object (CloudPassageSettings)
  },
  "cortexXdrSettings": {
    object (CortexXDRSettings)
  },
  "duoAuthSettings": {
    object (DuoAuthSettings)
  },
  "duoUserContextSettings": {
    object (DuoUserContextSettings)
  },
  "microsoftGraphAlertSettings": {
    object (MicrosoftGraphAlertSettings)
  },
  "microsoftSecurityCenterAlertSettings": {
    object (MicrosoftSecurityCenterAlertSettings)
  },
  "mimecastMailSettings": {
    object (MimecastMailSettings)
  },
  "office365Settings": {
    object (Office365Settings)
  },
  "proofpointMailSettings": {
    object (ProofpointMailSettings)
  },
  "recordedFutureIocSettings": {
    object (RecordedFutureIocSettings)
  },
  "workdaySettings": {
    object (WorkdaySettings)
  },
  "panIocSettings": {
    object (PanIocSettings)
  },
  "oktaSettings": {
    object (OktaSettings)
  },
  "oktaUserContextSettings": {
    object (OktaUserContextSettings)
  },
  "foxItStixSettings": {
    object (FoxITStixSettings)
  },
  "threatConnectIocSettings": {
    object (ThreatConnectIoCSettings)
  },
  "serviceNowCmdbSettings": {
    object (ServiceNowCMDBSettings)
  },
  "impervaWafSettings": {
    object (ImpervaWAFSettings)
  },
  "thinkstCanarySettings": {
    object (ThinkstCanarySettings)
  },
  "rhIsacIocSettings": {
    object (RHIsacIocSettings)
  },
  "rapid7InsightSettings": {
    object (Rapid7InsightSettings)
  },
  "salesforceSettings": {
    object (SalesforceSettings)
  },
  "netskopeAlertSettings": {
    object (NetskopeAlertSettings)
  },
  "azureMdmIntuneSettings": {
    object (AzureMDMIntuneSettings)
  },
  "azureAdSettings": {
    object (AzureADSettings)
  },
  "proofpointOnDemandSettings": {
    object (ProofpointOnDemandSettings)
  },
  "workspaceUsersSettings": {
    object (WorkspaceUsersSettings)
  },
  "workspaceActivitySettings": {
    object (WorkspaceActivitySettings)
  },
  "workspaceAlertsSettings": {
    object (WorkspaceAlertsSettings)
  },
  "workspacePrivilegesSettings": {
    object (WorkspacePrivilegesSettings)
  },
  "workspaceMobileSettings": {
    object (WorkspaceMobileSettings)
  },
  "workspaceChromeOsSettings": {
    object (WorkspaceChromeOSSettings)
  },
  "workspaceGroupsSettings": {
    object (WorkspaceGroupsSettings)
  },
  "azureAdAuditSettings": {
    object (AzureADAuditSettings)
  },
  "symantecEventExportSettings": {
    object (SymantecEventExportSettings)
  },
  "qualysVmSettings": {
    object (QualysVMSettings)
  },
  "panPrismaCloudSettings": {
    object (PanPrismaCloudSettings)
  },
  "gcsSettings": {
    object (GoogleCloudStorageSettings)
  },
  "httpSettings": {
    object (HttpSettings)
  },
  "sftpSettings": {
    object (SftpSettings)
  },
  "amazonS3Settings": {
    object (AmazonS3Settings)
  },
  "azureBlobStoreSettings": {
    object (AzureBlobStoreSettings)
  },
  "amazonSqsSettings": {
    object (AmazonSQSSettings)
  },
  "googleCloudIdentityDevicesSettings": {
    object (GoogleCloudIdentityDevicesSettings)
  },
  "googleCloudIdentityDeviceUsersSettings": {
    object (GoogleCloudIdentityDeviceUsersSettings)
  },
  "crowdstrikeDetectsSettings": {
    object (CrowdStrikeDetectsSettings)
  },
  "mandiantIocSettings": {
    object (MandiantIoCSettings)
  },
  "sentineloneAlertSettings": {
    object (SentineloneAlertSettings)
  },
  "qualysScanSettings": {
    object (QualysScanSettings)
  },
  "pubsubSettings": {
    object (PubsubSettings)
  },
  "amazonKinesisFirehoseSettings": {
    object (AmazonKinesisFirehoseSettings)
  },
  "webhookSettings": {
    object (WebhookSettings)
  },
  "dummyLogTypeSettings": {
    object (DummyLogTypeSettings)
  },
  "httpsPushGoogleCloudPubsubSettings": {
    object (HttpsPushGoogleCloudPubSubSettings)
  },
  "httpsPushAmazonKinesisFirehoseSettings": {
    object (HttpsPushAmazonKinesisFirehoseSettings)
  },
  "httpsPushWebhookSettings": {
    object (HttpsPushWebhookSettings)
  },
  "awsEc2HostsSettings": {
    object (AWSEC2HostsSettings)
  },
  "awsEc2InstancesSettings": {
    object (AWSEC2InstancesSettings)
  },
  "awsEc2VpcsSettings": {
    object (AWSEC2VpcsSettings)
  },
  "awsIamSettings": {
    object (AWSIAMSettings)
  },
  "netskopeAlertV2Settings": {
    object (NetskopeAlertV2Settings)
  },
  "gcsV2Settings": {
    object (GoogleCloudStorageV2Settings)
  },
  "amazonS3V2Settings": {
    object (AmazonS3V2Settings)
  },
  "amazonSqsV2Settings": {
    object (AmazonSQSV2Settings)
  },
  "azureEventHubSettings": {
    object (AzureEventHubSettings)
  },
  "trellixHxHostsSettings": {
    object (TrellixHxHostsSettings)
  },
  "azureBlobStoreV2Settings": {
    object (AzureBlobStoreV2Settings)
  },
  "trellixHxAlertsSettings": {
    object (TrellixHxAlertsSettings)
  },
  "googleCloudStorageEventDrivenSettings": {
    object (GoogleCloudStorageEventDrivenSettings)
  },
  "crowdstrikeAlertsSettings": {
    object (CrowdStrikeAlertsSettings)
  },
  "trellixHxBulkAcqsSettings": {
    object (TrellixHxBulkAcqsSettings)
  },
  "mimecastMailV2Settings": {
    object (MimecastMailV2Settings)
  },
  "threatConnectIocV3Settings": {
    object (ThreatConnectIoCV3Settings)
  }
  // End of list of possible types for union field details.
}
Fields
feedSourceType

enum (FeedSourceType)

Source Type of the feed.
logType

string

LogType. Format: projects/{project}/locations/{location}/instances/{instance}/logTypes/{log_type}
assetNamespace

string

The asset namespace to apply to all logs ingested through this feed.
labels

map (key: string, value: string)

The ingestion metadata labels to apply to all logs ingested through this feed, and the resulting normalized data.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
stsMigrationReadiness

enum (STSMigrationReadiness)

Optional. The status of the feed's migration to STS.
Union field details. Additional details of the feed. Depends on the feed type. details can be only one of the following:
anomaliSettings

object (AnomaliIocSettings)

Anomali IOC settings.
azureAdContextSettings

object (AzureADContextSettings)

Azure AD Context settings.
cloudPassageSettings

object (CloudPassageSettings)

Cloud Passage settings.
cortexXdrSettings

object (CortexXDRSettings)

Cortex XDR settings.
duoAuthSettings

object (DuoAuthSettings)

Duo Auth settings.
duoUserContextSettings

object (DuoUserContextSettings)

Duo User Context settings.
microsoftGraphAlertSettings

object (MicrosoftGraphAlertSettings)

Microsoft Graph Alert settings.
microsoftSecurityCenterAlertSettings

object (MicrosoftSecurityCenterAlertSettings)

Microsoft Security center alert settings.
mimecastMailSettings

object (MimecastMailSettings)

Mimecast mail settings.
office365Settings

object (Office365Settings)

Office 365 settings.
proofpointMailSettings

object (ProofpointMailSettings)

Proofpoint mail settings.
recordedFutureIocSettings

object (RecordedFutureIocSettings)

Recorded Future IOC settings.
workdaySettings

object (WorkdaySettings)

Workday settings.
panIocSettings

object (PanIocSettings)

PAN IOC settings.
oktaSettings

object (OktaSettings)

Okta settings.
oktaUserContextSettings

object (OktaUserContextSettings)

Okta user context settings.
foxItStixSettings

object (FoxITStixSettings)

Fox-IT STIX settings.
threatConnectIocSettings

object (ThreatConnectIoCSettings)

ThreatConnect IOC settings.
serviceNowCmdbSettings

object (ServiceNowCMDBSettings)

ServiceNow CMDB settings.
impervaWafSettings

object (ImpervaWAFSettings)

Imperva WAF settings.
thinkstCanarySettings

object (ThinkstCanarySettings)

Thinkst Canary settings.
rhIsacIocSettings

object (RHIsacIocSettings)

RH-ISAC IOC settings.
rapid7InsightSettings

object (Rapid7InsightSettings)

Rapid7 Insight settings.
salesforceSettings

object (SalesforceSettings)

Salesforce settings.
netskopeAlertSettings

object (NetskopeAlertSettings)

Netskope alert settings.
azureMdmIntuneSettings

object (AzureMDMIntuneSettings)

Azure MDM Intune settings.
azureAdSettings

object (AzureADSettings)

Azure AD settings.
proofpointOnDemandSettings

object (ProofpointOnDemandSettings)

Proofpoint On-Demand settings.
workspaceUsersSettings

object (WorkspaceUsersSettings)

Workspace users settings.
workspaceActivitySettings

object (WorkspaceActivitySettings)

Workspace activity settings.
workspaceAlertsSettings

object (WorkspaceAlertsSettings)

Workspace alerts settings.
workspacePrivilegesSettings

object (WorkspacePrivilegesSettings)

Workspace privileges settings.
workspaceMobileSettings

object (WorkspaceMobileSettings)

Workspace mobile settings.
workspaceChromeOsSettings

object (WorkspaceChromeOSSettings)

Workspace ChromeOS settings.
workspaceGroupsSettings

object (WorkspaceGroupsSettings)

Workspace Groups settings.
azureAdAuditSettings

object (AzureADAuditSettings)

Azure AD Audit settings.
symantecEventExportSettings

object (SymantecEventExportSettings)

Symantec Event Export settings.
qualysVmSettings

object (QualysVMSettings)

Qualys VM settings
panPrismaCloudSettings

object (PanPrismaCloudSettings)

PAN Prisma Cloud settings.
gcsSettings

object (GoogleCloudStorageSettings)

Google Cloud Storage settings.
httpSettings

object (HttpSettings)

HTTP settings.
sftpSettings

object (SftpSettings)

SFTP settings.
amazonS3Settings

object (AmazonS3Settings)

Amazon S3 settings.
azureBlobStoreSettings

object (AzureBlobStoreSettings)

Azure Blob Storage settings.
amazonSqsSettings

object (AmazonSQSSettings)

Amazon SQS settings.
googleCloudIdentityDevicesSettings

object (GoogleCloudIdentityDevicesSettings)

Google Cloud Identity Devices settings.
googleCloudIdentityDeviceUsersSettings

object (GoogleCloudIdentityDeviceUsersSettings)

Google Cloud Identity Device Users settings.
crowdstrikeDetectsSettings

object (CrowdStrikeDetectsSettings)

CrowdStrike Detects API settings.
mandiantIocSettings

object (MandiantIoCSettings)

Mandiant IOC settings.
sentineloneAlertSettings

object (SentineloneAlertSettings)

SentinelOne Alert settings.
qualysScanSettings

object (QualysScanSettings)

Qualys Scan Settings
pubsubSettings

object (PubsubSettings)

Pub/Sub settings.
amazonKinesisFirehoseSettings

object (AmazonKinesisFirehoseSettings)

Amazon Kinesis Firehose settings.
webhookSettings

object (WebhookSettings)

Webhook settings.
dummyLogTypeSettings

object (DummyLogTypeSettings)

DummyLogType Settings.
httpsPushGoogleCloudPubsubSettings

object (HttpsPushGoogleCloudPubSubSettings)

Https push Google Pub/Sub settings.
httpsPushAmazonKinesisFirehoseSettings

object (HttpsPushAmazonKinesisFirehoseSettings)

Https push Amazon Kinesis Firehose settings.
httpsPushWebhookSettings

object (HttpsPushWebhookSettings)

Https push Webhook settings.
awsEc2HostsSettings

object (AWSEC2HostsSettings)

AWS EC2 Hosts settings.
awsEc2InstancesSettings

object (AWSEC2InstancesSettings)

AWS EC2 Instances settings.
awsEc2VpcsSettings

object (AWSEC2VpcsSettings)

AWS EC2 Vpcs settings.
awsIamSettings

object (AWSIAMSettings)

AWS IAM settings.
netskopeAlertV2Settings

object (NetskopeAlertV2Settings)

Netskope alert V2 settings.
gcsV2Settings

object (GoogleCloudStorageV2Settings)

Settings for Google Cloud Storage Omniflow feeds.
amazonS3V2Settings

object (AmazonS3V2Settings)

Settings for S3 Omniflow feeds.
amazonSqsV2Settings

object (AmazonSQSV2Settings)

Settings for SQS Omniflow feeds.
azureEventHubSettings

object (AzureEventHubSettings)

Settings for Omniflow based native ingestion from azure event hub.
trellixHxHostsSettings

object (TrellixHxHostsSettings)

Settings for Trellix HX Host Metadata.
azureBlobStoreV2Settings

object (AzureBlobStoreV2Settings)

Settings for Azure Blobstore Omniflow feeds.
trellixHxAlertsSettings

object (TrellixHxAlertsSettings)

Settings for Trellix HX Alerts Metadata.
googleCloudStorageEventDrivenSettings

object (GoogleCloudStorageEventDrivenSettings)

Settings for Omniflow based Google Cloud Storage event driven feeds.
crowdstrikeAlertsSettings

object (CrowdStrikeAlertsSettings)

CrowdStrike Alerts API settings.
trellixHxBulkAcqsSettings

object (TrellixHxBulkAcqsSettings)

Settings for Trellix HX Bulk Acquisitions Metadata.
mimecastMailV2Settings

object (MimecastMailV2Settings)

Required. Mimecast mail v2 settings.
threatConnectIocV3Settings

object (ThreatConnectIoCV3Settings)

Threat Connect IOC V3 settings.

AnomaliIocSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.

UsernameSecretAuth

JSON representation 
{
  "user": string,
  "secret": string
}
Fields
user

string

Username of an identity used for authentication.
secret

string

Secret of the account identified by user_name.

AzureADContextSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "retrieveDevices": boolean,
  "retrieveGroups": boolean,
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
retrieveDevices

boolean

Whether to retrieve device information in user context.
retrieveGroups

boolean

Whether to retrieve group information in user context.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MicrosoftOAuthClientCredentials

JSON representation 
{
  "clientId": string,
  "clientSecret": string
}
Fields
clientId

string

Client ID.
clientSecret

string

Client secret.

CloudPassageSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "eventTypes": [
    string
  ]
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
eventTypes[]

string

Event types filter for the events API.

CortexXDRSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "endpoint": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
endpoint

string

API Endpoint.

HttpHeaderAuth

JSON representation 
{
  "headerKeyValues": [
    {
      object (HeaderKeyValue)
    }
  ]
}
Fields
headerKeyValues[]

object (HeaderKeyValue)

Header key-value pairs.

HeaderKeyValue

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string

Key.
value

string

Value.

DuoAuthSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.

DuoUserContextSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API hostname.

MicrosoftGraphAlertSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MicrosoftSecurityCenterAlertSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "subscriptionId": string,
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
subscriptionId

string

Subscription ID of the Microsoft security center alert settings alert.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

MimecastMailSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

Office365Settings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "contentType": enum (ContentType),
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
contentType

enum (ContentType)

Supported office 365 content type.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

ProofpointMailSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.

RecordedFutureIocSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  }
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.

WorkdaySettings

JSON representation 
{
  "authentication": {
    object (WorkdayAuth)
  },
  "hostname": string,
  "tenantId": string
}
Fields
authentication

object (WorkdayAuth)

Input only. Authentication.
hostname

string

API Hostname.
tenantId

string

Tenant ID.

WorkdayAuth

JSON representation 
{
  "user": string,
  "secret": string,
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "refreshToken": string
}
Fields
user

string

Username. This is unused: Workday feeds were originally configured using a username and secret authentication method, but only the secret field was used, and it was used to supply the OAuth access token.
secret

string

The access token used to authenticate against Workday. This field is called "secret" to maintain backwards compatibility. Workday was (only) configured using username (which was unused) and secret (which is used as the access token). Either this field or all of the other OAuth fields below must be specified.
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client Secret.
refreshToken

string

Refresh Token.

PanIocSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "feedId": string,
  "feed": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
feedId

string

PAN IOC feed ID.
feed

string

PAN IOC feed name.

OktaSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

OktaUserContextSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "managerIdReferenceField": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
managerIdReferenceField

string

Manager id reference field.

FoxITStixSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "ssl": {
    object (SSLClientKeypair)
  },
  "pollServiceUri": string,
  "collection": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
ssl

object (SSLClientKeypair)

SSL client key pair.
pollServiceUri

string

TAXII poll service URI.
collection

string

Collection available at the poll service.

SSLClientKeypair

JSON representation 
{
  "encodedPrivateKey": string,
  "sslCertificate": string
}
Fields
encodedPrivateKey

string

The encoded private key. The string should be a private key in PEM format, and should include the begin header and end footer lines. It may also include newlines.

Example: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,F23074E02CF47304

-----END RSA PRIVATE KEY-----
sslCertificate

string

The encoded SSL certificate. The string should be an SSL certificate in PEM format, and should include the begin header and end footer lines. It may also include newlines.

Example: -----BEGIN CERTIFICATE----- -----END CERTIFICATE-----

ThreatConnectIoCSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "owners": [
    string
  ]
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.
owners[]

string

Owners.

ServiceNowCMDBSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "feedname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.
feedname

string

Feedname.

ImpervaWAFSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  }
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.

ThinkstCanarySettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.

RHIsacIocSettings

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  }
}
Fields
authentication

object (OAuthClientCredentials)

Input only. Authentication.

OAuthClientCredentials

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string
}
Fields
tokenEndpoint

string

Token endpoint.
clientId

string

Client ID.
clientSecret

string

Client secret.

Rapid7InsightSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "endpoint": string,
  "hostname": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
endpoint

string

Rapid7 API endpoint. Should be "vulnerabilities" or "assets".
hostname

string

API Hostname.

SalesforceSettings

JSON representation 
{
  "hostname": string,

  // Union field authentication can be only one of the following:
  "oauthPasswordGrantAuth": {
    object (OAuthPasswordGrantCredentials)
  },
  "oauthJwtCredentials": {
    object (OAuthJWTCredentials)
  }
  // End of list of possible types for union field authentication.
}
Fields
hostname

string

API hostname.
Union field authentication. Possible types of authentication. authentication can be only one of the following:
oauthPasswordGrantAuth

object (OAuthPasswordGrantCredentials)

Input only. OAuthPasswordGrantCredentials auth.
oauthJwtCredentials

object (OAuthJWTCredentials)

Input only. OAuthJWTCredentials auth.

OAuthPasswordGrantCredentials

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "user": string,
  "password": string
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client secret.
user

string

Username.
password

string

Password.

OAuthJWTCredentials

JSON representation 
{
  "tokenEndpoint": string,
  "claims": {
    object (Claims)
  },

  // Union field credentials can be only one of the following:
  "rsCredentials": {
    object (RSCredentials)
  }
  // End of list of possible types for union field credentials.
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
claims

object (Claims)

Claims.
Union field credentials. Credentials. credentials can be only one of the following:
rsCredentials

object (RSCredentials)

RS credentials.

RSCredentials

JSON representation 
{
  "privateKey": string
}
Fields
privateKey

string

Private key in PEM format.

Claims

JSON representation 
{
  "issuer": string,
  "subject": string,
  "audience": string
}
Fields
issuer

string

Issuer. Usually the client_id.
subject

string

Subject. Usually the email.
audience

string

Audience.

NetskopeAlertSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "feedname": string,
  "contentType": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
feedname

string

Feedname.
contentType

string

Content type.

AzureMDMIntuneSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

AzureADSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

ProofpointOnDemandSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "clusterId": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
clusterId

string

Cluster ID.

WorkspaceUsersSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string,
  "projectionType": enum (ProjectionType)
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.
projectionType

enum (ProjectionType)

Optional. Projection Type.

WorkspaceActivitySettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string,
  "applications": [
    string
  ]
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.
applications[]

string

Applications.

WorkspaceAlertsSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspacePrivilegesSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceMobileSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceChromeOSSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

WorkspaceGroupsSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "workspaceCustomerId": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.
workspaceCustomerId

string

Customer ID.

AzureADAuditSettings

JSON representation 
{
  "authentication": {
    object (MicrosoftOAuthClientCredentials)
  },
  "tenantId": string,
  "hostname": string,
  "authEndpoint": string
}
Fields
authentication

object (MicrosoftOAuthClientCredentials)

Input only. Authentication.
tenantId

string

Tenant ID.
hostname

string

API Hostname.
authEndpoint

string

API Auth Endpoint.

SymantecEventExportSettings

JSON representation 
{
  "authentication": {
    object (OAuthRefreshToken)
  }
}
Fields
authentication

object (OAuthRefreshToken)

Input only. Authentication.

OAuthRefreshToken

JSON representation 
{
  "tokenEndpoint": string,
  "clientId": string,
  "clientSecret": string,
  "refreshToken": string
}
Fields
tokenEndpoint

string

Token endpoint to get the OAuth token from.
clientId

string

Client ID.
clientSecret

string

Client secret.
refreshToken

string

Refresh token.

QualysVMSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication.
hostname

string

API Hostname.

PanPrismaCloudSettings

JSON representation 
{
  "authentication": {
    object (PanPrismaAuth)
  },
  "hostname": string
}
Fields
authentication

object (PanPrismaAuth)

Input only. Authentication.
hostname

string

API Hostname.

PanPrismaAuth

JSON representation 
{
  "user": string,
  "password": string
}
Fields
user

string

Username.
password

string

Password.

GoogleCloudStorageSettings

JSON representation 
{
  "bucketUri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption),
  "chronicleServiceAccount": string
}
Fields
bucketUri

string

Bucket URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.
chronicleServiceAccount

string

Output only. Service Account Chronicle will be using to pull data.

HttpSettings

JSON representation 
{
  "uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
uri

string

HTTP URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SftpSettings

JSON representation 
{
  "authentication": {
    object (SftpAuth)
  },
  "uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (SftpAuth)

Input only. Authentication.
uri

string

SFTP URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SftpAuth

JSON representation 
{
  "username": string,
  "password": string,
  "privateKey": string,
  "privateKeyPassphrase": string
}
Fields
username

string

Username. Used for username and password authentication.
password

string

Password. Used for username and password authentication.
privateKey

string

Private key. Used for private key authentication.
privateKeyPassphrase

string

Private key passphrase. Used for private key authentication.

AmazonS3Settings

JSON representation 
{
  "authentication": {
    object (S3Auth)
  },
  "s3Uri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (S3Auth)

Input only. Authentication.
s3Uri

string

S3 URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

S3Auth

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string,
  "clientId": string,
  "clientSecret": string,
  "refreshUri": string,
  "region": enum (S3Region)
}
Fields
accessKeyId

string

Access key ID. Used when using access key auth.
secretAccessKey

string

Secret access key. Used when using access key auth.
clientId

string

Client ID. Used when using OAuth auth.
clientSecret

string

Client secret. Used when using OAuth auth.
refreshUri

string

Refresh URI. Used when using OAuth auth.
region

enum (S3Region)

S3 Region.

AzureBlobStoreSettings

JSON representation 
{
  "authentication": {
    object (AzureAuth)
  },
  "azureUri": string,
  "sourceType": enum (URISourceType),
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
authentication

object (AzureAuth)

Input only. Authentication.
azureUri

string

Azure URI.
sourceType

enum (URISourceType)

The URI source type.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

AzureAuth

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "sharedKey": string,
  "sasToken": string
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. Type of auth used with Azure. auth_type can be only one of the following:
sharedKey

string

Shared Key.
sasToken

string

SAS Token.

AmazonSQSSettings

JSON representation 
{
  "region": enum (S3Region),
  "queue": string,
  "accountNumber": string,
  "authentication": {
    object (SQSAuth)
  },
  "sourceDeletionOption": enum (SourceDeletionOption)
}
Fields
region

enum (S3Region)

S3 Region.
queue

string

Name of the queue.
accountNumber

string

Account number of the owner of the queue.
authentication

object (SQSAuth)

Input only. Authentication.
sourceDeletionOption

enum (SourceDeletionOption)

Source deletion option.

SQSAuth

JSON representation 
{
  "sqsAccessKeySecretAuth": {
    object (SQSAccessKeySecretAuth)
  },
  "additionalS3AccessKeySecretAuth": {
    object (AdditionalS3AccessKeySecretAuth)
  }
}
Fields
sqsAccessKeySecretAuth

object (SQSAccessKeySecretAuth)

SQS access key secret auth.
additionalS3AccessKeySecretAuth

object (AdditionalS3AccessKeySecretAuth)

Authentication for the S3 bucket referred to by the items in the SQS queue. This is only required if it is different from the authentication for the queue.

SQSAccessKeySecretAuth

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID.
secretAccessKey

string

Secret access key.

AdditionalS3AccessKeySecretAuth

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID.
secretAccessKey

string

Secret access key.

GoogleCloudIdentityDevicesSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  },
  "apiVersion": string
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication
apiVersion

string

API Version

GoogleCloudIdentityDeviceUsersSettings

JSON representation 
{
  "authentication": {
    object (OAuthJWTCredentials)
  }
}
Fields
authentication

object (OAuthJWTCredentials)

Input only. Authentication.

CrowdStrikeDetectsSettings

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  },
  "hostname": string,
  "ingestionType": enum (IngestionType)
}
Fields
authentication

object (OAuthClientCredentials)

Input only. OAuthClientCredentials.
hostname

string

API Hostname.
ingestionType

enum (IngestionType)

Optional. Ingestion Type.

MandiantIoCSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "startTime": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
startTime

string (Timestamp format)

time since when to start fetching the IOCs

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

Timestamp

JSON representation 
{
  "seconds": string,
  "nanos": integer
}
Fields
seconds

string (int64 format)

Represents seconds of UTC time since Unix epoch 1970-01-01T00:00:00Z. Must be between -62135596800 and 253402300799 inclusive (which corresponds to 0001-01-01T00:00:00Z to 9999-12-31T23:59:59Z).
nanos

integer

Non-negative fractions of a second at nanosecond resolution. This field is the nanosecond portion of the duration, not an alternative to seconds. Negative second values with fractions must still have non-negative nanos values that count forward in time. Must be between 0 and 999,999,999 inclusive.

SentineloneAlertSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "initialStartTime": string,
  "isAlertApiSubscribed": boolean
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

Hostname of SentinelOne alert settings.
initialStartTime

string

initialStartTime from when to fetch the alerts
isAlertApiSubscribed

boolean

Is the customer subscribed to Alerts Api

QualysScanSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "apiType": enum (ApiType)
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication
hostname

string

Hostname.
apiType

enum (ApiType)

Supported Qualys Scan api type.

PubsubSettings

JSON representation 
{
  "googleServiceAccountEmail": string
}
Fields
googleServiceAccountEmail

string

Google Service Account Email.

DummyLogTypeSettings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "apiEndpoint": string
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
apiEndpoint

string

Full API Endpoint.

HttpsPushGoogleCloudPubSubSettings

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

HttpsPushAmazonKinesisFirehoseSettings

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

HttpsPushWebhookSettings

JSON representation 
{
  "splitDelimiter": string
}
Fields
splitDelimiter

string

Optional. Delimiter to split on for the feed.

AWSEC2HostsSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSEC2InstancesSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSEC2VpcsSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  }
}
Fields
authentication

object (UsernameSecretAuth)

Input only. UsernameSecretAuth.

AWSIAMSettings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "apiType": enum (ApiType)
}
Fields
authentication

object (UsernameSecretAuth)

Input only. Authentication
apiType

enum (ApiType)

Supported AWS IAM api type.

NetskopeAlertV2Settings

JSON representation 
{
  "authentication": {
    object (HttpHeaderAuth)
  },
  "hostname": string,
  "contentCategory": string,
  "contentTypes": [
    string
  ]
}
Fields
authentication

object (HttpHeaderAuth)

Input only. Authentication.
hostname

string

API Hostname.
contentCategory

string

Content Category.
contentTypes[]

string

Content type.

GoogleCloudStorageV2Settings

JSON representation 
{
  "bucketUri": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "chronicleServiceAccount": string,
  "maxLookbackDays": integer
}
Fields
bucketUri

string

Required. Google Cloud Storage Bucket URI for the feed.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option determines if the data from the source is to be deleted after ingestion.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.

AmazonS3V2Settings

JSON representation 
{
  "authentication": {
    object (S3AuthV2)
  },
  "s3Uri": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
authentication

object (S3AuthV2)

Required. Authentication.
s3Uri

string

Required. S3 URI.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

S3AuthV2

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "accessKeySecretAuth": {
    object (S3V2AccessKeySecretAuth)
  },
  "awsIamRoleAuth": {
    object (S3V2AwsIamRoleAuth)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. auth type for S3. auth_type can be only one of the following:
accessKeySecretAuth

object (S3V2AccessKeySecretAuth)

Access Key ID and Secret Access Key for an AWS account.
awsIamRoleAuth

object (S3V2AwsIamRoleAuth)

AWS IAM Role Auth for Identity Federation.

S3V2AccessKeySecretAuth

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Required. Access Key ID for an AWS account (a 20-character, alphanumeric string).
secretAccessKey

string

Required. Secret Access Key for an AWS account (a 40-character string).

S3V2AwsIamRoleAuth

JSON representation 
{
  "awsIamRoleArn": string,
  "subjectId": string
}
Fields
awsIamRoleArn

string

AWS IAM Role for Identity Federation.
subjectId

string

Subject ID to use for S3.

AmazonSQSV2Settings

JSON representation 
{
  "queue": string,
  "s3Uri": string,
  "authentication": {
    object (SQSAuthV2)
  },
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
queue

string

Required. Amazon Resource Name(ARN) of the queue.
s3Uri

string

Required. S3 URI.
authentication

object (SQSAuthV2)

Required. Authentication.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

SQSAuthV2

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "sqsV2AccessKeySecretAuth": {
    object (SQSV2AccessKeySecretAuth)
  },
  "awsIamRoleAuth": {
    object (SQSV2AwsIamRoleAuth)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. auth tyoe for the SQS queue. auth_type can be only one of the following:
sqsV2AccessKeySecretAuth

object (SQSV2AccessKeySecretAuth)

Required. Auth key and secret for the SQS queue.
awsIamRoleAuth

object (SQSV2AwsIamRoleAuth)

Required. AWS IAM Role for Identity Federation.

SQSV2AccessKeySecretAuth

JSON representation 
{
  "accessKeyId": string,
  "secretAccessKey": string
}
Fields
accessKeyId

string

Access key ID of the S3 bucket. Ex: AKIABCDEFGHIJKL.
secretAccessKey

string

Secret access key to access the S3 bucket.

SQSV2AwsIamRoleAuth

JSON representation 
{
  "awsIamRoleArn": string,
  "subjectId": string
}
Fields
awsIamRoleArn

string

AWS IAM Role for Identity Federation.
subjectId

string

Subject ID to use for SQS.

AzureEventHubSettings

JSON representation 
{
  "name": string,
  "consumerGroup": string,
  "eventHubConnectionString": string,
  "azureStorageConnectionString": string,
  "azureStorageContainer": string,
  "azureSasToken": string,
  "eventHubNamespace": string
}
Fields
name

string

Required. Event hub to read from.
consumerGroup

string

Required. Event hub consumer group to read from.
eventHubConnectionString

string

Required. Event hub connection string for authentication.
azureStorageConnectionString

string

Optional. Blob store connection string for authentication.
azureStorageContainer

string

Optional. Blob storage container name.
azureSasToken

string

Optional. SAS token
eventHubNamespace

string

Output only. Event hub namespace

TrellixHxHostsSettings

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

TrellixStarXAuthentication

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "msso": {
    object (MssoAuthentication)
  },
  "trellixIam": {
    object (TrellixIAMAuthentication)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. One of multiple potential auth types. auth_type can be only one of the following:
msso

object (MssoAuthentication)

Input only. MssoAuthentication auth type.
trellixIam

object (TrellixIAMAuthentication)

Input only. TrellixIAMAuthentication auth type.

MssoAuthentication

JSON representation 
{
  "username": string,
  "password": string,
  "apiEndpoint": string
}
Fields
username

string

Required. Username for MSSO authentication. There are no restrictions on the format of the username. It has no default, specifically enforced min / max length or character set. The username will have been provided by an MSSO administrator and it is assumed that they have provided a username that is internally consistent with MSSO authentication requirements / validation.
password

string

Required. Password of the account identified by username. There are no restrictions on the format of the password. It has no default, specifically enforced min / max length or character set. The password will have been provided by an MSSO administrator and it is assumed that they have provided a password that is internally consistent with MSSO authentication requirements / validation.
apiEndpoint

string

Required. The login api endpoint url. This must be a valid URL with an http or https scheme. It has no default.

TrellixIAMAuthentication

JSON representation 
{
  "clientId": string,
  "clientSecret": string,
  "scope": string
}
Fields
clientId

string

Required. Client ID generated in Trellix IAM. This is a unique identifier for the user that is generated in Trellix IAM. It has no default, specifically enforced min / max length or character set. It is assumed that the Client ID generated in Trellix IAM is internally consistent with Trellix IAM authentication requirements / validation.
clientSecret

string

Required. Secret associated with the Client ID. This is the secret generated in Trellix IAM for the Client ID. It has no default, specifically enforced min / max length or character set. It is assumed that the secret generated in Trellix IAM is internally consistent with Trellix IAM authentication requirements / validation.
scope

string

Required. OAUTH 2 scope to request for the authentication token. This is the OAUTH 2 scope to request for the authentication token. It has no default, specifically enforced min / max length or character set. It is assumed that the scope provided is internally consistent with Trellix IAM authentication requirements / validation.

AzureBlobStoreV2Settings

JSON representation 
{
  "azureUri": string,
  "authentication": {
    object (AzureAuthV2)
  },
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "maxLookbackDays": integer,
  "chronicleServiceAccount": string
}
Fields
azureUri

string

Required. Azure URI.
authentication

object (AzureAuthV2)

Required. Authentication.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.

AzureAuthV2

JSON representation 
{

  // Union field auth_type can be only one of the following:
  "accessKey": string,
  "sasToken": string,
  "azureV2WorkloadIdentityFederation": {
    object (AzureV2WorkloadIdentityFederation)
  }
  // End of list of possible types for union field auth_type.
}
Fields
Union field auth_type. Possible types of authentication. auth_type can be only one of the following:
accessKey

string

Required. Access Key also known as shared key.
sasToken

string

Required. SAS Token.
azureV2WorkloadIdentityFederation

object (AzureV2WorkloadIdentityFederation)

Required. Azure V2 Workload Identity Federation.

AzureV2WorkloadIdentityFederation

JSON representation 
{
  "clientId": string,
  "tenantId": string,
  "subjectId": string
}
Fields
clientId

string

Required. OAuth client ID.
tenantId

string

Required. Tenant ID.
subjectId

string

Required. Subject ID of the Azure subscription.

TrellixHxAlertsSettings

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

GoogleCloudStorageEventDrivenSettings

JSON representation 
{
  "bucketUri": string,
  "pubsubSubscription": string,
  "sourceDeletionOption": enum (SourceDeletionOptionV2),
  "chronicleServiceAccount": string,
  "maxLookbackDays": integer
}
Fields
bucketUri

string

Required. Google Cloud Storage Bucket URI for the feed.
pubsubSubscription

string

Required. Subscription name for pubsub topic.
sourceDeletionOption

enum (SourceDeletionOptionV2)

Optional. Source deletion option determines if the data from the source is to be deleted after ingestion.
chronicleServiceAccount

string

Output only. SA that will read data, this is Storage Transfer Service SA of Customer's Tenancy Project.
maxLookbackDays

integer

Optional. Maximum File Age to ingest in days.

CrowdStrikeAlertsSettings

JSON representation 
{
  "authentication": {
    object (OAuthClientCredentials)
  },
  "hostname": string,
  "ingestionType": enum (IngestionType)
}
Fields
authentication

object (OAuthClientCredentials)

Required. OAuthClientCredentials.
hostname

string

Required. API Hostname.
ingestionType

enum (IngestionType)

Optional. Ingestion Type.

TrellixHxBulkAcqsSettings

JSON representation 
{
  "authentication": {
    object (TrellixStarXAuthentication)
  },
  "endpoint": string
}
Fields
authentication

object (TrellixStarXAuthentication)

Required. Authentication.
endpoint

string

Required. Trellix HX Device URL. This must be a valid URL with an http or https scheme. It has no default. Usually a device URL is in the form of either: https://xxx.trellix.com/hx/id// - or - https://htapdeviceproxy.md.mandiant.net/dphb/hx//

MimecastMailV2Settings

JSON representation 
{
  "authCredentials": {
    object (MimecastV2OAuthClientCredentials)
  }
}
Fields
authCredentials

object (MimecastV2OAuthClientCredentials)

Required. Mimecast OAuthClientCredentials.

MimecastV2OAuthClientCredentials

JSON representation 
{
  "clientId": string,
  "clientSecret": string
}
Fields
clientId

string

Required. Client ID.
clientSecret

string

Required. Client Secret.

ThreatConnectIoCV3Settings

JSON representation 
{
  "authentication": {
    object (UsernameSecretAuth)
  },
  "hostname": string,
  "owners": [
    string
  ],
  "tqlQuery": string,
  "fields": [
    string
  ],
  "schedule": integer
}
Fields
authentication

object (UsernameSecretAuth)

Required. Input only. UsernameSecretAuth.
hostname

string

Required. hostname.
owners[]

string

Required. Owners.
tqlQuery

string

Optional. ThreatConnect Query Language filter.
fields[]

string

Optional. Fields
schedule

integer

Optional. Schedule

LabelsEntry

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string
value

string

FeedFailureDetails

JSON representation 
{
  "errorCode": string,
  "httpErrorCode": integer,
  "errorCause": string,
  "errorAction": string
}
Fields
errorCode

string

Output only. error_code contains the error code for the feed. The field is populated for the feeds with failed status.
httpErrorCode

integer

Output only. http_error_code contains the HTTP error code for the feed failure. feed transfer failure may or may not result in http error code.
errorCause

string

Output only. error_cause contains the information regarding the failure cause.
errorAction

string

Output only. error_action contains the user action prescribed for remediation of feed error.

Tool Annotations

Destructive Hint: ❌ | Idempotent Hint: ✅ | Read Only Hint: ✅ | Open World Hint: ❌