GetDetection (V2) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V2 API (GetDetection) to the modern Chronicle API (LegacyGetDetection).

Protocol and mapping overview

Feature Legacy API (GetDetection V2) Modern Chronicle API (LegacyGetDetection)
HTTP method GET GET
Permissions Partner token or legacy API keys chronicle.googleapis.com/legacies.legacyGetDetection

Request payload field-by-field parity

The modern Chronicle API LegacyGetDetectionRequest scopes queries under parent project instances and renames segment path parameters.

Legacy field (GetDetectionRequest) Modern field (LegacyGetDetectionRequest) Field type Parity & migration notes
— instance (in HTTP path) string Google Cloud scoping context / new field: Scopes extraction under target instance environments: projects/{project}/locations/{location}/instances/{instance_uuid}.
version_id rule_id string Renamed: Target rule identification segment name (can accept {rule_id} or {rule_id}@{revision_id}). Rename to ruleId in JSON. Note: Proto tag number changed from 1 to 2.
detection_id detection_id string Direct map / identical: Opaque detection identifier string. Rename to detectionId in JSON. Note: Proto tag number changed from 2 to 3.

Response payload field-by-field parity

Both endpoints return the identical parsed telemetry detection Collection output.

Legacy field (.backstory.Collection response) Modern field (.backstory.Collection response) Field type Parity & notes
.backstory.Collection .backstory.Collection Collection Parity mapped: Returns the matching detection resource representation under identical structures.

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under parent project instance folder bindings (instance path parameter).
  • Proto tag rearrangements:
    • Proto tags in requests shifted to accommodate parent path integrations (rule_id tag from 1 to 2, detection_id from 2 to 3).
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission validation check (chronicle.googleapis.com/legacies.legacyGetDetection).