Method: actionExecutor.fetchActionDetails

Full name: projects.locations.instances.actionExecutor.fetchActionDetails

Fetch detailed descriptions and parameter schemas for specific actions on a SIEM alert.

HTTP request

POST https://{endpoint}/v1alpha/{parent}/actionExecutor:fetchActionDetails

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns the collection of actions.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "siemAlertId": string,
  "actions": [
    {
      object (ActionIdentifier)
    }
  ],
  "alertUseCase": string,
  "actionCategory": enum (ActionCategory),
  "outcomeCategories": [
    string
  ]
}
Fields
siemAlertId

string

Required. The identifier of the SIEM alert.
actions[]

object (ActionIdentifier)

Required. The list of (integration, action) pairs to fetch details for.
alertUseCase

string

Optional. Optional alert use case to validate that the requested actions are permitted for the classified use case.
actionCategory

enum (ActionCategory)

Optional. Optional action category to filter actions by. Defaults to ACTION_CATEGORY_REMEDIATION when omitted or ACTION_CATEGORY_UNSPECIFIED.
outcomeCategories[]

string

Optional. Optional outcome categories to filter by.

Response body

Response for actionExecutor.fetchActionDetails.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "actions": [
    {
      object (ActionDetails)
    }
  ],
  "notAllowedActions": [
    {
      object (ActionIdentifier)
    }
  ]
}
Fields
actions[]

object (ActionDetails)

Detailed descriptions and parameter schemas for the valid and allowed requested actions.
notAllowedActions[]

object (ActionIdentifier)

Requested (integration, action) pairs that do not exist, are not configured in the alert's environment, or are not permitted for the specified alert use case.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle

For more information, see the Authentication Overview.

ActionIdentifier

Identifies an action by its integration and action name.

JSON representation 
{
  "integration": string,
  "action": string
}
Fields
integration

string

Required. The integration identifier.
action

string

Required. The action display name.

ActionDetails

Detailed instructions and parameter schemas for an action.

JSON representation 
{
  "integration": string,
  "action": string,
  "aiDescription": string,
  "parametersDescription": string,
  "parameters": [
    {
      object (ActionParameterDetails)
    }
  ]
}
Fields
integration

string

The integration identifier.
action

string

The action display name.
aiDescription

string

The detailed AI description for the action (with fallback to legacy description).
parametersDescription

string

The pre-formatted AI Markdown parameter table/guide.
parameters[]

object (ActionParameterDetails)

The parameter schemas for the action.

ActionParameterDetails

Parameter schema details required for parameter selection.

JSON representation 
{
  "name": string,
  "type": string,
  "description": string,
  "mandatory": boolean,
  "defaultValue": string,
  "optionalValuesJson": string
}
Fields
name

string

The name of the parameter.
type

string

The type of the parameter (e.g., "String", "Boolean", "List", "MultipleChoiceParameter", "Email").
description

string

The description of the parameter.
mandatory

boolean

Whether the parameter is mandatory.
defaultValue

string

The default value of the parameter.
optionalValuesJson

string

The optional values of the parameter as a JSON string.