Method: uniqueEntities.fetchFull

Full name: projects.locations.instances.uniqueEntities.fetchFull

Fetches comprehensive information for a unique entity. This includes not just basic metadata but also related cases, distribution statistics, and environmental context, providing a complete overview of the entity's impact. Case metrics and related cases cover only the past three months.

HTTP request

POST https://{endpoint}/v1/{parent}/uniqueEntities:fetchFull

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. Format: projects/{project}/locations/{location}/instances/{instance}/uniqueEntities

Request body

The request body contains an instance of FetchFullUniqueEntity.

Response body

Response message for uniqueEntities.fetchFull. Case information (related cases, case counts, and case distribution) covers only the past three months.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "entity": {
    object (UniqueEntity)
  },
  "relatedCases": [
    {
      object (RelatedCase)
    }
  ],
  "environments": [
    string
  ],
  "linkedEntities": [
    {
      object (UniqueEntity)
    }
  ],
  "notes": [
    {
      object (SoarEntityNote)
    }
  ],
  "caseDistributionRecords": [
    {
      object (SoarCasesDistribution)
    }
  ],
  "allCasesCount": integer,
  "maliciousCasesCount": integer
}
Fields
entity

object (UniqueEntity)

Output only. The full unique entity.
relatedCases[]

object (RelatedCase)

Output only. The related cases the entity was involved in during the past three months.
environments[]

string

Output only. The related environments.
linkedEntities[]

object (UniqueEntity)

Output only. The related entities.
notes[]

object (SoarEntityNote)

Output only. The related entity notes.
caseDistributionRecords[]

object (SoarCasesDistribution)

Output only. The related cases distribution during the past three months.
allCasesCount

integer

Output only. The total number of cases the entity was involved in during the past three months.
maliciousCasesCount

integer

Output only. The total number of malicious cases the entity was involved in during the past three months.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.uniqueEntities.get

For more information, see the IAM documentation.

FetchFullUniqueEntity

Request message for uniqueEntities.fetchFull. Case information returned for the entity covers only the past three months.

JSON representation 
{
  "identifier": string,
  "type": string,
  "environment": string,
  "lastCaseType": enum (LastCaseType),
  "caseDistributionType": enum (CaseDistributionType)
}
Fields
identifier

string

Required. Unique identifier of the entity.
type

string

Required. Type of the entity.
environment

string

Required. Environment of the entity (e.g., "prod", "dev").
lastCaseType

enum (LastCaseType)

Optional. Last case type of the entity.
caseDistributionType

enum (CaseDistributionType)

Optional. Case distribution type.

LastCaseType

Enum representing the last case type.

Enums
ALL All case types.
CLOSED Closed last case type.
OPENED Opened last case type.

CaseDistributionType

Enum representing the case distribution type.

Enums
PRODUCT Product case distribution type.
TAG Tag case distribution type.

RelatedCase

The related case.

JSON representation 
{
  "priority": enum (Priority),
  "description": string,
  "closureDetails": {
    object (RelatedCaseClosureDetails)
  },
  "id": string,
  "createTime": string,
  "status": enum (RelatedCaseDataState),
  "displayName": string
}
Fields
priority

enum (Priority)

Output only. Case priority.
description

string

Output only. Case description.
closureDetails

object (RelatedCaseClosureDetails)

Output only. Case closure details.
id

string (int64 format)

Output only. Related Case Id.
createTime

string (int64 format)

Output only. Creation time of the case.
status

enum (RelatedCaseDataState)

Output only. Case data status.
displayName

string

Output only. Case display name.

RelatedCaseClosureDetails

Case closure details.

JSON representation 
{
  "reason": enum (RelatedCaseCloseReason),
  "rootCause": string,
  "comment": string
}
Fields
reason

enum (RelatedCaseCloseReason)

Output only. Case closure reason.
rootCause

string

Output only. root cause of the case.
comment

string

Output only. clouse comment of the case.

RelatedCaseCloseReason

Case closure reason.

Enums
CLOSE_REASON_UNSPECIFIED Unspecified close reason.
MALICIOUS Case is malicious.
NOT_MALICIOUS Case is not malicious.
MAINTENANCE Case is in maintenance.
INCONCLUSIVE Case is inconclusive.
UNKNOWN Case closure reason is unknown.

RelatedCaseDataState

Case data status.

Enums
CASE_DATA_STATE_UNSPECIFIED Unspecified case data status.
OPENED Case data is opened.
CLOSED Case data is closed.
ALL Case data is all.
MERGED Case data is merged.
CREATION_PENDING Case data is creation pending.

SoarEntityNote

Soar entity note.

JSON representation 
{
  "author": string,
  "content": string,
  "id": string,
  "createTime": string
}
Fields
author

string

Output only. Author of the note.
content

string

Output only. Content of the note.
id

string (int64 format)

Output only. Unique identifier of the note.
createTime

string (int64 format)

Output only. Creation time of the note.

SoarCasesDistribution

Soar cases distribution.

JSON representation 
{
  "displayName": string,
  "count": integer,
  "productFamily": string
}
Fields
displayName

string

Output only. Display name of the case.
count

integer

Output only. Number of cases.
productFamily

string

Output only. Product family of the case.