Method: enrichmentAgent.executeActions

Full name: projects.locations.instances.enrichmentAgent.executeActions

Executes a list of manual actions on a given SIEM alert.

HTTP request

POST https://{endpoint}/v1alpha/{parent}/enrichmentAgent:executeActions

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns the collection of actions.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "siemAlertId": string,
  "actions": [
    {
      object (ExecuteActionRequest)
    }
  ]
}
Fields
siemAlertId

string

Required. The identifier of the SIEM alert.
actions[]

object (ExecuteActionRequest)

Required. The actions to execute.

Response body

Response for enrichmentAgent.executeActions. Details of an list of actions that will be executed.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "parent": string,
  "results": [
    {
      object (ExecuteActionResult)
    }
  ],
  "executionTimeSeconds": number
}
Fields
parent

string

Output only. The parent, which owns the collection of actions.
results[]

object (ExecuteActionResult)

The results of the actions.
executionTimeSeconds

number

Output only. The execution time of the actions in seconds.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.enrichmentAgent.execute

For more information, see the IAM documentation.