Method: cases.merge

Full name: projects.locations.instances.cases.merge

Merges one or more cases into a single destination case. This is useful when multiple cases are determined to be part of the same security investigation.

HTTP request


POST https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{parent}/cases:merge

Path parameters

Parameters
parent

string

Required. The instance to merge cases on. Format: projects/{project}/locations/{location}/instances/{instance}/cases

Request body

The request body contains data with the following structure:

JSON representation 
{
  "casesIds": [
    integer
  ],
  "caseToMergeWith": integer
}
Fields
casesIds[]

integer

Required. Cases to merge.
caseToMergeWith

integer

Required. Case to merge with.

Response body

Response message for cases.merge.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "newCaseId": integer,
  "isRequestValid": boolean,
  "errors": [
    string
  ]
}
Fields
newCaseId

integer

Output only. New caseId if request is successful, null otherwise.
isRequestValid

boolean

Output only. Flag that indicates whether the request is valid or not.
errors[]

string

Output only. Error list if request is invalid.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.cases.update

For more information, see the IAM documentation.