# LegacyCreateSoarAlert APIs request and response mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the Legacy Backstory API (**`CreateSoarAlert`** ) to the modern Chronicle API ([**`LegacyCreateSoarAlert`**](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.legacy/legacyCreateSoarAlert)).

## Protocol and mapping overview

| Feature | Legacy API (`CreateSoarAlert`) | Modern Chronicle API (`LegacyCreateSoarAlert`) |
|---|---|---|
| **HTTP method** | `POST` | `POST` |
| **Permissions** | Legacy partner permissions | `chronicle.googleapis.com/legacies.legacyCreateSoarAlert` |

*** ** * ** ***

## Request payload field-by-field parity

The legacy call ingested an alert from other SIEM systems using Chronicle SOAR. The modern Chronicle API targets a specific instance path and provides the same alert ingestion capabilities using `LegacyCreateSoarAlertRequest`.

| Legacy field (`CreateSoarAlertRequest`) | Modern field (`LegacyCreateSoarAlertRequest`) | Field type | Parity and migration notes |
|---|---|---|---|
| --- | `instance` (in HTTP path) | `string` | **Google Cloud scoped hierarchy:** In the legacy API, the target customer was authenticated globally without a resource hierarchy path. In the modern API, the request targets a specific instance resource path: `projects/{project}/locations/{location}/instances/{instance}`. |
| `soar_alert` | `soar_alert` | `LegacySoarAlert` | **Parity mapped:** Encapsulates the alert payload to be ingested. Maps directly between `SoarAlert` and `LegacySoarAlert`. |
| `soar_alert.soar_alert_id` | `soar_alert.soar_alert_id` | `string` | **Parity mapped:** ID of the alert in the Chronicle SOAR product. |
| `soar_alert.start_time` | `soar_alert.start_time` | `google.protobuf.Timestamp` | **Parity mapped:** Start time of the window for which the alert was generated. |
| `soar_alert.end_time` | `soar_alert.end_time` | `google.protobuf.Timestamp` | **Parity mapped:** End time of the window for which the alert was generated. |
| `soar_alert.detection_time` | `soar_alert.detection_time` | `google.protobuf.Timestamp` | **Parity mapped:** Timestamp when the alert was detected. |
| `soar_alert.source_rule` | `soar_alert.source_rule` | `string` | **Parity mapped:** Name of the rule triggering the alert in the source SIEM. |
| `soar_alert.source_system_uri` | `soar_alert.source_system_uri` | `string` | **Parity mapped:** URI to the source SIEM system. |
| `soar_alert.vendor` | `soar_alert.vendor` | `string` | **Parity mapped:** Name of the vendor. |
| `soar_alert.source_system` | `soar_alert.source_system` | `string` | **Parity mapped:** Name of the source SIEM system. |
| `soar_alert.product` | `soar_alert.product` | `string` | **Parity mapped:** Name of the product generating the alert. |
| `soar_alert.original_ticket_id` | `soar_alert.original_ticket_id` | `string` | **Parity mapped:** Ticket ID for the alert in the source SIEM system. |
| `soar_alert.priority` | `soar_alert.priority` | `string` | **Parity mapped:** Priority of the alert. |
| `soar_alert.severity` | `soar_alert.severity` | `string` | **Parity mapped:** Severity of the alert. |
| `soar_alert.events` | `soar_alert.events` | `repeated SoarEvent` | **Parity mapped:** List of events associated with the alert. |
| `soar_alert.description` | `soar_alert.description` | `string` | **Parity mapped:** Description of the alert. |
| `soar_alert.summary` | `soar_alert.summary` | `string` | **Parity mapped:** Summary of the alert. |
| `soar_alert.name` | `soar_alert.name` | `string` | **Parity mapped:** Name of the alert in the SecOps platform. |
| `soar_alert.alert_group_id` | `soar_alert.alert_group_id` | `string` | **Parity mapped:** Alert identifier in SOAR unique per customer, used to enforce idempotency. |
| `soar_alert.soar_create_time` | `soar_alert.soar_create_time` | `google.protobuf.Timestamp` | **Parity mapped:** Timestamp when the alert was created in SOAR. |

*** ** * ** ***

## Response payload field-by-field parity

The response returns the created SOAR alert resource.

| Legacy field (`SoarAlert` response) | Modern field (`LegacySoarAlert` response) | Target type | Parity and migration notes |
|---|---|---|---|
| `soar_alert_id` | `soar_alert_id` | `string` | **Parity mapped:** ID of the alert in Chronicle SOAR. |
| `start_time` | `start_time` | `google.protobuf.Timestamp` | **Parity mapped:** Start time of the window. |
| `end_time` | `end_time` | `google.protobuf.Timestamp` | **Parity mapped:** End time of the window. |
| `detection_time` | `detection_time` | `google.protobuf.Timestamp` | **Parity mapped:** Detection timestamp. |
| `source_rule` | `source_rule` | `string` | **Parity mapped:** Rule name in the source SIEM. |
| `source_system_uri` | `source_system_uri` | `string` | **Parity mapped:** Source SIEM system URI. |
| `vendor` | `vendor` | `string` | **Parity mapped:** Vendor name. |
| `source_system` | `source_system` | `string` | **Parity mapped:** Source SIEM system name. |
| `product` | `product` | `string` | **Parity mapped:** Product name. |
| `original_ticket_id` | `original_ticket_id` | `string` | **Parity mapped:** Source ticket ID. |
| `priority` | `priority` | `string` | **Parity mapped:** Alert priority. |
| `severity` | `severity` | `string` | **Parity mapped:** Alert severity. |
| `events` | `events` | `repeated SoarEvent` | **Parity mapped:** Related events. |
| `description` | `description` | `string` | **Parity mapped:** Alert description. |
| `summary` | `summary` | `string` | **Parity mapped:** Alert summary. |
| `name` | `name` | `string` | **Parity mapped:** SecOps alert resource name. |
| `alert_group_id` | `alert_group_id` | `string` | **Parity mapped:** Idempotency group ID. |
| `soar_create_time` | `soar_create_time` | `google.protobuf.Timestamp` | **Parity mapped:** SOAR creation timestamp. |

*** ** * ** ***

## Key differences

- **Google Cloud scoped hierarchy:**
  - The modern Chronicle API targets a specific instance resource path: `projects/{project}/locations/{location}/instances/{instance}`.
- **Full payload compatibility:**
  - All fields within `SoarAlert` and nested `SoarEvent` objects map directly to `LegacySoarAlert` and `SoarEvent` with identical types and field tags.