Method: cases.createInsight

• HTTP request
• Path parameters
• Request body
  • JSON representation
• Response body
• Authorization scopes
• IAM Permissions

Full name: projects.locations.instances.cases.createInsight

Adds an insight to a Case. Insights are analyst-provided or automation-generated notes, observations, or critical pieces of information discovered during the case investigation.

HTTP request

Choose a location:

africa-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-central2 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu

POST https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{name}:createInsight

Path parameters

Parameters
name	string Required. The resource name of the Case to create Insight for. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}

Request body

The request body contains data with the following structure:

JSON representation
{ "triggeredBy": string, "title": string, "content": string, "entityIdentifier": string, "severity": enum (CaseInsightSeverity), "type": enum (CaseInsightType), "additionalDataType": enum (CaseInsightType), "additionalData": string, "additionalDataTitle": string, "entityType": string, "alertIdentifier": string, "isFavorite": boolean }

Fields
triggeredBy	string Optional. User who triggered the case insight.
title	string Required. Insight title.
content	string Required. Insight content.
entityIdentifier	string Optional. Entity identifier.
severity	enum (CaseInsightSeverity) Optional. Case insight severity.
type	enum (CaseInsightType) Optional. Case insight type.
additionalDataType	enum (CaseInsightType) Optional. Case additional data insight type.
additionalData	string Optional. Case Insight additional data.
additionalDataTitle	string Optional. Case Insight additional data.
entityType	string Optional. Entity type.
alertIdentifier	string Optional. Alert identifier to create insight for.
isFavorite	boolean Optional. Is Favoriting Insight.

Response body

If successful, the response body is empty.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/chronicle
• https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

• chronicle.cases.update

For more information, see the IAM documentation.