Method: events.list

Full name: projects.locations.instances.cases.events.list

Lists events for a case.

HTTP request


GET https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{parent}/events

Path parameters

Parameters
parent

string

Required. The parent case or detection resource name. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}

Query parameters

Parameters
pageSize

integer

Optional. The maximum number of events to return. The service may return fewer than this value. The default value is 50. The maximum value is 1000; values above 1000 will be coerced to 1000.
pageToken

string

Optional. A page token, received from a previous events.list call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to events.list must match the call that provided the page token.
filter

string

Optional. A filter to apply to the list of events. The fields supported for filtering are: Supported operators include =, !=, <, >, <=, >=, AND, OR, NOT. - Fields within the event UDM proto (e.g., event.metadata.event_type, event.principal.hostname).
orderBy

string

Optional. Configures ordering of events in the response. The default sorting order is ascending. To specify descending order for a field, append a " desc" suffix. Supported fields: Fields within the event UDM proto (e.g., event.metadata.event_type, event.principal.hostname).

Request body

The request body must be empty.

Response body

Response message for events.list.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "caseEvents": [
    {
      object (CaseEvent)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
caseEvents[]

object (CaseEvent)

The list of events.
nextPageToken

string

A token, which can be sent as pageToken to retrieve the next page. If this field is omitted, there are no subsequent pages.
totalSize

integer

Total number of events matching the filter. Used for UI pagination counts.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.