# REST Resource: projects.locations.instances.cases.caseAlerts

- [Resource: CaseAlert](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#CaseAlert)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#CaseAlert.SCHEMA_REPRESENTATION)
- [AlertClosureDetails](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertClosureDetails)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertClosureDetails.SCHEMA_REPRESENTATION)
- [CloseReason](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#CloseReason)
- [LegacyCasePriority](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#LegacyCasePriority)
- [AlertStatus](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertStatus)
- [InvolvedRelation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#InvolvedRelation)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#InvolvedRelation.SCHEMA_REPRESENTATION)
- [EntityKey](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey.SCHEMA_REPRESENTATION)
- [WorkflowStatus](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#WorkflowStatus)
- [AlertTag](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertTag)
  - [JSON representation](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertTag.SCHEMA_REPRESENTATION)
- [Methods](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#METHODS_SUMMARY)

## Resource: CaseAlert

Security notifications tied to specific data identified as a potential threat by security systems. In SecOps, investigating alerts provides critical context about the underlying activity and its relationships to entities and other security events.

| JSON representation |
|---|
| ``` { "name": string, "identifier": string, "caseId": integer, "createTime": string, "updateTime": string, "ruleGenerator": string, "sourceGroupingIdentifier": string, "product": string, "displayName": string, "vendor": string, "environment": string, "ticketId": string, "sourceSystemName": string, "closureDetails": { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertClosureDetails`) }, "sla": { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/Sla`) }, "manual": boolean, "priority": enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#LegacyCasePriority`), "sourceIdentifier": string, "additionalProperties": string, "status": enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertStatus`), "startTime": string, "endTime": string, "involvedRelations": [ { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#InvolvedRelation`) } ], "siemAlertId": string, "sourceUrl": string, "sourceRuleUrl": string, "sourceSystemUrl": string, "sourceRuleIdentifier": string, "playbookStatus": enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#WorkflowStatus`), "attachedPlaybookName": string, "nestingDepth": integer, "alertGroupIdentifier": string, "eventCount": integer, "tags": [ { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertTag`) } ], "playbookRunCount": integer } ``` |

| Fields ||
|---|---|
| `name` | `string` Identifier. The unique name(ID) of the CaseAlert. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}/caseAlerts/{caseAlert} |
| `identifier` | `string` Output only. Title + Guid, e.g. ACCESS DISABLED ACCOUNTS_3A0C90F9-A87E-4E94-8727-7884F686ECDA Legacy identifier of alert used across the legacy modules in the system. Char limit: 2100 |
| `caseId` | `integer` Output only. Case associated with the alert. Added for convenience to be used by the UI. |
| `createTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. The creation time of the record in milliseconds. |
| `updateTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. The modification time of the record in milliseconds. |
| `ruleGenerator` | `string` Output only. Which rule triggered the alert on the third party. This can be any rule defined in the third party Such SIEM, Splunk, CrowdStrike. Characters limit: 250. |
| `sourceGroupingIdentifier` | `string` Output only. A key on the alert that can be used to group alerts to the same case. Characters limit: 2100 |
| `product` | `string` Output only. The product associated with the alert. E.g. DLP, WinEventLog:Security |
| `displayName` | `string` Output only. The display name of the alert. E.g. "DATA EXFILTRATION" |
| `vendor` | `string` Output only. The vendor of the alert. E.g. "Microsoft". Characters limit: 2100 |
| `environment` | `string` Output only. The environment of the alert. |
| `ticketId` | `string` Output only. Third party ticket id, can be originated from SIEM or other tools. E.g. "3a0c90f9-a87e-4e94-8727-7884f686ecda" |
| `sourceSystemName` | `string` Output only. Which alerting system raises the alert. E.g. "QRadar", "Arcsight", "Microsoft CASB". The Integration Name in soar. |
| `closureDetails` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertClosureDetails`)`` Optional. Defines the close reason of an alert if any. |
| `sla` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/Sla`)`` Optional. SLA (Service Level Agreement) for the specific alert, used also to calculate aggregate case sla. |
| `manual` | `boolean` Output only. Whether the alert was created manually. |
| `priority` | ``enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#LegacyCasePriority`)`` Optional. Default value is HIGH. |
| `sourceIdentifier` | `string` Output only. Stores the identifier of the source of the alert, could be a connector identifier etc. |
| `additionalProperties` | `string` Output only. Stores additional data on specific alerts, currently used by connectors, in JSON format. |
| `status` | ``enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertStatus`)`` Optional. Alert status. Default value is OPEN. |
| `startTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. When the alert was created on the third party product (SIEM, IPS, etc). |
| `endTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. When the alert was closed on the third party product (SIEM, IPS, etc). |
| `involvedRelations[]` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#InvolvedRelation`)`` Output only. All involved relations for the alert. Directional connection between entities in a given alert. |
| `siemAlertId` | `string` Output only. The identifier of the alert int SIEM. |
| `sourceUrl` | `string` Output only. The source URL of the alert. |
| `sourceRuleUrl` | `string` Output only. The source rule URL of the alert. |
| `sourceSystemUrl` | `string` Output only. The source system URL. |
| `sourceRuleIdentifier` | `string` Output only. The source rule identifier. |
| `playbookStatus` | ``enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#WorkflowStatus`)`` Output only. Alert playbook status. |
| `attachedPlaybookName` | `string` Output only. The attached playbook name. |
| `nestingDepth` | `integer` Output only. The nesting depth of the alert. |
| `alertGroupIdentifier` | `string` Output only. The alert group identifier. |
| `eventCount` | `integer` Output only. The number of events that triggered the alert. |
| `tags[]` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#AlertTag`)`` Optional. AlertTags associated with the alert. |
| `playbookRunCount` | `integer` Output only. The number of times the first playbook was run on the alert. |

## AlertClosureDetails

Alert closure details.

| JSON representation |
|---|
| ``` { "reason": enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#CloseReason`), "comment": string, "rootCause": string, "closingTimeMs": string } ``` |

| Fields ||
|---|---|
| `reason` | ``enum (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#CloseReason`)`` Output only. Alert closure reason. |
| `comment` | `string` Output only. Alert closure comment. |
| `rootCause` | `string` Output only. Alert closure root cause. |
| `closingTimeMs` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. Alert closure time in unix format as milliseconds. |

## CloseReason

Alert closure reason.

| Enums ||
|---|---|
| `CLOSE_REASON_UNSPECIFIED` | Unspecified close reason. |
| `MALICIOUS` | Case is malicious. |
| `NOT_MALICIOUS` | Case is not malicious. |
| `MAINTENANCE` | Case is in maintenance. |
| `INCONCLUSIVE` | Case is inconclusive. |
| `UNKNOWN` | Case closure reason is unknown. |

## LegacyCasePriority

Legacy Case priority.

| Enums ||
|---|---|
| `LEGACY_CASE_PRIORITY_UNSPECIFIED` | Case priority is unspecified. |
| `UNCHANGED` | Unchanged case priority. |
| `INFORMATIVE` | Informative case priority. |
| `LOW` | Low case priority. |
| `MEDIUM` | Medium case priority. |
| `HIGH` | High case priority. |
| `CRITICAL` | Critical case priority. |

## AlertStatus

Alert status.

| Enums ||
|---|---|
| `ALERT_STATUS_UNSPECIFIED` | The alert status is unspecified. |
| `OPEN` | The alert is open |
| `CLOSE` | The alert is closed. |

## InvolvedRelation

Displays a connection between entities for a given alert.

| JSON representation |
|---|
| ``` { "identifier": string, "alertIdentifier": string, "caseId": integer, "relationType": string, "from": { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey`) }, "to": { object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey`) }, "deviceProduct": string, "deviceVendor": string, "categoryOutcome": string, "destinationPort": string, "eventClassId": string, "startTime": string, "endTime": string, "additionalProperties": string } ``` |

| Fields ||
|---|---|
| `identifier` | `string` Required. The identifier of the relation. |
| `alertIdentifier` | `string` Output only. The identifier of the alert the relation belongs to. |
| `caseId` | `integer` Output only. The id of the case the relation belongs to. |
| `relationType` | `string` Output only. The type of the relation. |
| `from` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey`)`` Output only. The source of the relation. |
| `to` | ``object (`https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts#EntityKey`)`` Output only. The destination of the relation. |
| `deviceProduct` | `string` Output only. The product. |
| `deviceVendor` | `string` Output only. The vendor. |
| `categoryOutcome` | `string` Output only. The category outcome. Blocked/Allowed/null. |
| `destinationPort` | `string` Output only. The destination port, if relevant |
| `eventClassId` | `string` Output only. Event display name. For example: Email Check, Data Exfiltration, IRC etc. |
| `startTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. Start time of the involved relation. |
| `endTime` | `string (https://developers.google.com/discovery/v1/type-format format)` Output only. End time of the involved relation. |
| `additionalProperties` | `string` Output only. Additional data, stored in JSON format. |

## EntityKey

Identifies an entity, used to display connections between entities for a given alert.

| JSON representation |
|---|
| ``` { "identifier": string, "type": string } ``` |

| Fields ||
|---|---|
| `identifier` | `string` Output only. The identifier of the entity. |
| `type` | `string` Output only. The type of the entity. |

## WorkflowStatus

Workflow status.

| Enums ||
|---|---|
| `WORKFLOW_STATUS_UNSPECIFIED` | Unspecified workflow status. |
| `NONE` | Workflow status is none. |
| `IN_PROGRESS` | Workflow is running. |
| `COMPLETED` | Workflow is completed. |
| `FAILED` | Workflow is failed. |
| `TERMINATED` | Workflow is terminated. |
| `PENDING_IN_QUEUE` | Workflow is pending in queue. |
| `PENDING_FOR_USER` | Workflow is pending for user. |
| `PENDING_PREVIOUS_COMPLETION` | Workflow is pending previous completion. |

## AlertTag

AlertTag associated with the alert.

| JSON representation |
|---|
| ``` { "tag": string } ``` |

| Fields ||
|---|---|
| `tag` | `string` Output only. The name of the tag |

| ## Methods ||
|---|---|
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/addTag` | Add a case alert tag. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/createRecommendationLongRunning` | Initiates an asynchronous request to generate a new AI recommendation for an alert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/fetchRecommendation` | Fetches a previously generated AI-driven recommendation for an alert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/get` | Gets a single CaseAlert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/getAlertOverviewData` | Retrieves a view of widgets for a specific alert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/list` | Lists CaseAlerts within a specific Case. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/listAlertViews` | Lists the different UI views available for presenting an alert's data. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/move` | Moves a CaseAlert to a different Case. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/patch` | Updates an existing CaseAlert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/pauseSla` | Pauses the SLA timer for a CaseAlert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/removeTag` | Remove a case alert tag. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/resolveOverviewWidget` | Resolves the data for a specific alert overview widget. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/resumeSla` | Resumes a previously paused SLA timer for a CaseAlert. |
| ### `https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseAlerts/setSla` | Sets the Service Level Agreement (SLA) for a specific CaseAlert. |