EnableLiveRule (V2) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V2 API (EnableLiveRule) to the modern Chronicle API (UpdateRuleDeployment).

Protocol and mapping overview

Feature Legacy API (EnableLiveRule V2) Modern Chronicle API (UpdateRuleDeployment)
HTTP method POST PATCH
Permissions Partner token or legacy API keys chronicle.googleapis.com/ruleDeployments.update

Request payload field-by-field parity

The legacy backstory API implemented enabling live rules as a dedicated POST RPC endpoint. The modern Chronicle API models live evaluation as a PATCH modification of enabled (setting to true) and run_frequency (setting to LIVE) on the sub-resource RuleDeployment.

Legacy field (EnableLiveRuleRequest) Modern field (UpdateRuleDeploymentRequest / RuleDeployment) Field type Parity & migration notes
rule_id rule_deployment.name (in HTTP path) string Google Cloud scoping / resource unification: Legacy passed the raw rules engine parameter rule_id. The modern API routes this using parent resource paths: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
— rule_deployment.enabled bool Target attribute mapping: Set enabled = true to activate continuous rule execution.
— rule_deployment.run_frequency enum Target attribute mapping: Set run_frequency = LIVE to configure streaming real-time detection. Rename to runFrequency in JSON.
— update_mask FieldMask Required mask: Include enabled,run_frequency in JSON updateMask.

Response payload field-by-field parity

In legacy backstory, EnableLiveRule returned an empty response. In the modern API, UpdateRuleDeployment returns the modified deployment state.

Legacy field (Empty response) Modern field (RuleDeployment response) Field type Parity & migration notes
google.protobuf.Empty name string Canonical resource path name: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
— enabled bool Returns true confirming rule deployment is enabled.
— run_frequency enum Returns LIVE confirming continuous streaming mode is running.
— alerting and archived bool Returns other deployment properties.

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under parent project instance folder bindings (rule_deployment.name path parameter).
  • Stateful attributes (enabled, run_frequency):
    • Rather than launching custom POST endpoints :enableLiveRule, live execution is parameterized by setting enabled = true and run_frequency = LIVE inside the sub-resource RuleDeployment.
  • Execution dependency on archive states:
    • Attempting to enable continuous execution fails if the rule deployment is archived (archived = true). The client must restore the rule from the archived state first.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission validation check (chronicle.googleapis.com/ruleDeployments.update).