AgentSettings

This message represents the agent settings for an instance

JSON representation 
{
  "name": string,
  "autoInvestigationEnabled": boolean,
  "alertFilter": string,
  "autoInvestigationDelay": string,
  "quotaInfo": {
    object (QuotaInfo)
  },
  "aiSecurityTokenBillingSettings": {
    object (AiSecurityTokenBillingSettings)
  }
}
Fields
name

string

Identifier. The resource name of the AgentSettings. Format: projects/{project}/locations/{location}/instances/{instance}/agentSettings
autoInvestigationEnabled

boolean

Optional. Whether auto investigation is enabled for the instance.
alertFilter

string

Optional. A single AIP-160 string representing the instance provided alert filters used for auto investigation when default settings are disabled, e.g. “detection.rule_name = /enumeration/ AND detection.detection.rule_id != 1234 AND udm.metadata.event_type = /USER_LOGIN/”.
autoInvestigationDelay

string (Duration format)

Optional. The delay after which auto investigation will be triggered for an alert when default settings are disabled. This is only applied if autoInvestigationEnabled is true.

A duration in seconds with up to nine fractional digits, ending with 's'. Example: "3.5s".
quotaInfo

object (QuotaInfo)

Output only. The quota information for the instance.
aiSecurityTokenBillingSettings

object (AiSecurityTokenBillingSettings)

Optional. Billing and Token controls for AI features.

QuotaInfo

Represents the information about an instance's quota status.

JSON representation 
{
  "autoInvestigationsQuotaLimit": string,
  "manualInvestigationsQuotaLimit": string
}
Fields
autoInvestigationsQuotaLimit

string (int64 format)

Output only. The quota limit for auto investigations for the instance.
manualInvestigationsQuotaLimit

string (int64 format)

Output only. The quota limit for manual investigations for the instance.

AiSecurityTokenBillingSettings

Billing and Token controls for AI features.

JSON representation 
{
  "paidTokenEnabled": boolean,
  "billingModel": enum (BillingModel),
  "includedTokenCount": string,
  "updateTime": string,
  "totalPaidTokenAllocation": string,
  "usedIncludedTokens": string,
  "usedPaidTokens": string,
  "dailyPaidTokenLimit": string
}
Fields
paidTokenEnabled

boolean

Required. Bool representing whether customer has opted their tenant in to Paid Security Tokens. They will only be able to toggle this on if they have a valid BillingModel set.
billingModel

enum (BillingModel)

Output only. The billing model describes how they're billed based on the SKU purchased by the customer.
includedTokenCount

string (int64 format)

Output only. Total daily baseline complimentary token budget included with the purchased package tier.
updateTime

string (Timestamp format)

Output only. Timestamp of the last mutation to these settings.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
totalPaidTokenAllocation

string (int64 format)

Output only. Total reservoir of paid Security Tokens allocated to this tenant.
usedIncludedTokens

string (int64 format)

Output only. Used tokens from the baseline complimentary budget today.
usedPaidTokens

string (int64 format)

Output only. Total paid tokens consumed from the allocation.
dailyPaidTokenLimit

string (int64 format)

Optional. Granular daily cap in paid Security Tokens.

BillingModel

The billing model describes how they're billed based on the SKU purchased by the customer.

Enums
BILLING_MODEL_UNSPECIFIED Default unspecified billing model.
SUBSCRIPTION Subscription-based billing model.
PAYGO Pay-As-You-Go billing model.