Method: rules.list

Full name: projects.locations.instances.rules.list

Lists Rules.

HTTP request

GET https://{endpoint}/v1/{parent}/rules

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns this collection of rules. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
pageSize

integer

The maximum number of rules to return. The service may return fewer than this value. If unspecified, at most 100 rules will be returned. The maximum value is 1000; values above 1000 will be coerced to 1000.
pageToken

string

A page token, received from a previous rules.list call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to rules.list must match the call that provided the page token.
view

enum (RuleView)

view indicates the scope of fields to populate for the Rule being returned. If unspecified, defaults to BASIC.
filter

string

Only the following filters are allowed: "referenceLists:{reference_list_name}" "dataTables:{data_table_name}" "displayName:{displayName}"
orderBy

string

Optional. The sort order of the rules. If unspecified, rules will be sorted by revisionCreateTime desc ruleId asc. Sorting is supported on a single field only. Composite sort keys are not supported. See https://google.aip.dev/132#ordering for more details.

Supported fields: "archived", "alertingEnabled", "author", "createTime", "currentDayDetectionCount", "displayName", "executionState", "liveModeEnabled", "revisionCreateTime", "ruleId", "ruleOwner", "severity", "type".

Example: "displayName desc"
skip

integer

Optional. The number of rules to skip in the response. When a skip value is provided, the API will bypass the specified number of rules before returning results. This allows for arbitrary navigation through the results. If not specified, no rules will be skipped and the API will return results starting from the provided pageToken. Skipping is only supported in TRENDS view.

Request body

The request body must be empty.

Response body

Response message for rules.list method.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "rules": [
    {
      object (Rule)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
rules[]

object (Rule)

The rules from the specified instance.
nextPageToken

string

A token, which can be sent as pageToken to retrieve the next page. If this field is omitted, there are no subsequent pages.
totalSize

integer

An estimate of the total number of rules that match the query. This value is only populated when the view is TRENDS.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.rules.list

For more information, see the IAM documentation.