Method: actionExecutor.fetchActions

Full name: projects.locations.instances.actionExecutor.fetchActions

List all actions that can be executed on a given SIEM alert.

HTTP request

GET https://{endpoint}/v1alpha/{parent}/actionExecutor:fetchActions

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns the collection of actions.

Query parameters

Parameters
siemAlertId

string

Required. The identifier of the SIEM alert.
alertUseCase

string

Optional. Optional alert use case to resolve into outcome categories.
outcomeCategories[]

string

Optional. Optional outcome categories to filter by.
actionCategory

enum (ActionCategory)

Optional. Optional action category to filter actions by. Defaults to ACTION_CATEGORY_REMEDIATION when omitted or ACTION_CATEGORY_UNSPECIFIED.

Request body

The request body must be empty.

Response body

Response for actionExecutor.fetchActions.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "actions": [
    {
      object (ActionSummary)
    }
  ]
}
Fields
actions[]

object (ActionSummary)

List of actions that can be executed on the SIEM alert.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle

For more information, see the Authentication Overview.

ActionSummary

Summary details of an action.

JSON representation 
{
  "integration": string,
  "integrationInstance": string,
  "action": string,
  "entityTypes": [
    string
  ],
  "shortDescription": string
}
Fields
integration

string

The integration identifier.
integrationInstance

string

The integration instance identifier.
action

string

The action display name.
entityTypes[]

string

The supported target entity types for this action.
shortDescription

string

A short description of the action.