We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

LegacyCreateOrUpdateCase parity mapping

Supported in:

Google secops SIEM

This guide details the request and response mapping specifications and property parity analysis for migrating from the Legacy Backstory API (CreateOrUpdateCase) to the modern Chronicle API (LegacyCreateOrUpdateCase).

Protocol and mapping overview

Feature	Legacy API (`CreateOrUpdateCase`)	Modern Chronicle API (`LegacyCreateOrUpdateCase`)
HTTP method	`POST`	`POST`
Permissions	Legacy partner permissions	`chronicle.googleapis.com/legacies.legacyCreateOrUpdateCase`

Request payload field-by-field parity

The legacy call created or updated a case. The modern Chronicle API targets a specific instance path and provides case creation and update capabilities with backward compatibility for integrations.

Legacy field (`CreateOrUpdateCaseRequest`)	Modern field (`LegacyCreateOrUpdateCaseRequest`)	Field type	Parity and migration notes
—	`instance` (in HTTP path)	`string`	Google Cloud scoped hierarchy: In the legacy API, the target instance was not specified in the resource path. In the modern API, the request targets a specific instance resource path: `projects/{project}/locations/{location}/instances/{instance}`.
`case_resource`	`case_resource`	`LegacyCase`	Parity mapped: Encapsulates the case payload to create or update.
`case_resource.name`	`case_resource.id`	`string`	Field name change: In the legacy Backstory API, the case identifier was specified in the `name` field (format: `cases/{case}`). In the modern API, the identifier is provided using the `id` field.
`case_resource.response_platform_info`	`case_resource.soar_platform_info`	`SoarPlatformInfo`	Field name change: Renamed from `response_platform_info` to `soar_platform_info`. Contains case metadata in the customer's SOAR platform.
`case_resource.response_platform_info.case_id`	`case_resource.soar_platform_info.case_id`	`string`	Parity mapped: Identifier of the case in the SOAR platform.
`case_resource.response_platform_info.response_platform_type`	`case_resource.soar_platform_info.response_platform_type`	`ResponsePlatformType`	Parity mapped: Type of SOAR platform. Supported values: `RESPONSE_PLATFORM_TYPE_UNSPECIFIED` (0), `RESPONSE_PLATFORM_TYPE_SIEMPLIFY` (1).
`case_resource.display_name`	`case_resource.display_name`	`string`	Parity mapped: Display name of the case.
`case_resource.stage`	`case_resource.stage`	`string`	Parity mapped: Stage of the case (for example, "Triage", "Assessment", "Investigation", "Incident", "Improvement", "Research", or custom user-defined values).
`case_resource.priority`	`case_resource.priority`	`Priority`	Parity mapped: Case priority (`PRIORITY_UNSPECIFIED`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`).
`case_resource.status`	`case_resource.status`	`Status`	Parity mapped: Case status (`STATUS_UNSPECIFIED`, `OPEN`, `CLOSED`).
`case_resource.alert_ids`	`case_resource.alert_ids`	`repeated string`	Parity mapped: List of alert IDs associated with this case.

Response payload field-by-field parity

The response returns the created or updated case resource.

Legacy field (`Case` response)	Modern field (`LegacyCase` response)	Target type	Parity and migration notes
`name`	`id`	`string`	Field name change: In the legacy Backstory API, the case identifier was returned in `name` (format: `cases/{case}`). In the modern API, the identifier is returned in `id`.
`response_platform_info`	`soar_platform_info`	`SoarPlatformInfo`	Field name change: Renamed from `response_platform_info` to `soar_platform_info`.
`response_platform_info.case_id`	`soar_platform_info.case_id`	`string`	Parity mapped: Case ID in the customer's SOAR platform.
`response_platform_info.response_platform_type`	`soar_platform_info.response_platform_type`	`ResponsePlatformType`	Parity mapped: Response platform type enum identifier.
`display_name`	`display_name`	`string`	Parity mapped: Display name of the case.
`stage`	`stage`	`string`	Parity mapped: Case stage identifier.
`priority`	`priority`	`Priority`	Parity mapped: Priority level of the case.
`status`	`status`	`Status`	Parity mapped: Status of the case.
`alert_ids`	`alert_ids`	`repeated string`	Parity mapped: Associated alert IDs.

Key differences

Google Cloud scoped hierarchy:
- The modern Chronicle API targets a specific instance path: projects/{project}/locations/{location}/instances/{instance}.
Identifier field naming:
- The legacy Backstory API represented the case identifier using name (cases/{case}), while the modern API accepts and returns the identifier in the id field.
SOAR platform field naming:
- The legacy Backstory API uses response_platform_info (ResponsePlatformInfo), whereas the modern API uses soar_platform_info (SoarPlatformInfo), preserving the same nested field structure (case_id and response_platform_type).