CaseEvidence

Represents a piece of evidence associated with a Chronicle case. Evidence can be of various types, such as alerts, detections, or events.

JSON representation 
{
  "evidenceType": enum (EvidenceType),
  "evidenceId": string,
  "attachTime": string,
  "attacher": string,
  "sourceEvidenceId": string,
  "sourceEvidenceType": enum (EvidenceType),
  "sourceEvidenceKey": string,
  "soarEvidenceId": string
}
Fields
evidenceType

enum (EvidenceType)

Output only. The type of evidence.
evidenceId

string

Output only. The unique identifier of the evidence.
attachTime

string (Timestamp format)

Output only. The timestamp when the evidence was attached to the Case.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
attacher

string

Output only. The user who attached the evidence to the Case.
sourceEvidenceId

string

Output only. The ID of the evidence that this evidence was extracted from.
sourceEvidenceType

enum (EvidenceType)

Output only. The type of evidence that this evidence was extracted from.
sourceEvidenceKey

string

Output only. The key of the evidence that this evidence was extracted from.
soarEvidenceId

string

Output only. The ID of the evidence in SOAR.

EvidenceType

Describes the type of evidence a case evidence is. Note: This enum is not frozen and new values are likely to be added in the future.

Enums
EVIDENCE_TYPE_UNSPECIFIED The evidence type is unspecified.
EVIDENCE_TYPE_ALERT The evidence type is alert.
EVIDENCE_TYPE_EVENT The evidence type is event.
EVIDENCE_TYPE_DETECTION The evidence type is detection.
EVIDENCE_TYPE_ENTITY The evidence type is entity.
EVIDENCE_TYPE_RULE_MATCH_ENTITY The evidence type is rule match entity.
EVIDENCE_TYPE_RULE_OUTCOME_ENTITY The evidence type is rule outcome entity.
EVIDENCE_TYPE_UDM_PRINCIPAL_ENTITY The evidence type is UDM entity principal.
EVIDENCE_TYPE_UDM_TARGET_ENTITY The evidence type is UDM entity target.
EVIDENCE_TYPE_UDM_ABOUT_ENTITY The evidence type is UDM entity about.
EVIDENCE_TYPE_THREAT_HUNT The evidence type is threat hunt.