Method: enrichmentAgent.executeRemediationActions

Full name: projects.locations.instances.enrichmentAgent.executeRemediationActions

Executes a list of remediation actions on a given SIEM alert.

HTTP request

POST https://{endpoint}/v1alpha/{parent}/enrichmentAgent:executeRemediationActions

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns the collection of actions.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "siemAlertId": string,
  "actions": [
    {
      object (ExecuteActionRequest)
    }
  ]
}
Fields
siemAlertId

string

Required. The identifier of the SIEM alert.
actions[]

object (ExecuteActionRequest)

Required. The actions to execute.

Response body

Response for enrichmentAgent.executeRemediationActions.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "results": [
    {
      object (ExecuteActionResult)
    }
  ],
  "executionTimeSeconds": number
}
Fields
results[]

object (ExecuteActionResult)

The results of the actions.
executionTimeSeconds

number

Output only. The execution time of the actions in seconds.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.