Method: enrichmentAgent.fetchActions

Full name: projects.locations.instances.enrichmentAgent.fetchActions

List all actions that can be executed on a given SIEM alert.

HTTP request

GET https://{endpoint}/v1alpha/{parent}/enrichmentAgent:fetchActions

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
parent

string

Required. The parent, which owns the collection of actions.

Query parameters

Parameters
siemAlertId

string

Required. The identifier of the SIEM alert.
expand

string

Optional. Expand the response to include the full impact analysis actions metadata object. Supported values: * impactAnalysisActionsMetadata
targetRelevance

string

Optional. Filter the response to include only actions with the specified target relevance. Supported filters: * asset_criticality: Filter by the asset criticality.
view

enum (EnrichmentAgentView)

Optional. The response view. Defaults to ENRICHMENT_AGENT_VIEW_FULL.

Request body

The request body must be empty.

Response body

Response for enrichmentAgent.fetchActions.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "parent": string,
  "integrations": [
    {
      object (AgentIntegrationDetails)
    }
  ]
}
Fields
parent

string

Output only. The parent, which owns the collection of actions.
integrations[]

object (AgentIntegrationDetails)

List of all integrations that can be used to execute actions on the SIEM alert.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.enrichmentAgent.get

For more information, see the IAM documentation.