Method: enrichmentAgent.fetchAlertData

Full name: projects.locations.instances.enrichmentAgent.fetchAlertData

Retrieves data for a specific SIEM alert for a context for the enrichment agent.

HTTP request


GET https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{parent}/enrichmentAgent:fetchAlertData

Path parameters

Parameters
parent

string

Required. The resource name of the enrichment agent Format: projects/{project}/locations/{location}/instances/{instance}/enrichmentAgent:

Query parameters

Parameters
siemAlertId

string

Required. The identifier of the SIEM alert.

Request body

The request body must be empty.

Response body

Response for GetAlertData.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "parent": string,
  "caseAlert": {
    object (MinimalInvolvedThreatIndicator)
  },
  "entities": [
    {
      object (MinimalInvolvedEntity)
    }
  ],
  "events": [
    {
      object (MinimalInvolvedMappedEvent)
    }
  ],
  "executedActions": [
    {
      object (MinimalActionResult)
    }
  ],
  "comments": [
    string
  ]
}
Fields
parent

string

Output only. The parent, which owns the collection of actions.
caseAlert

object (MinimalInvolvedThreatIndicator)

The case alert.
entities[]

object (MinimalInvolvedEntity)

The entities involved in the alert.
events[]

object (MinimalInvolvedMappedEvent)

The events involved in the alert.
executedActions[]

object (MinimalActionResult)

The actions executed on the alert.
comments[]

string

The comments on the alert.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

MinimalInvolvedThreatIndicator

Minimal information about a threat indicator.

JSON representation 
{
  "ruleGenerator": string,
  "product": string,
  "displayName": string,
  "vendor": string,
  "sourceSystemName": string,
  "originalName": string,
  "sourceSystemUrl": string,
  "sourceRuleIdentifier": string
}
Fields
ruleGenerator

string

The rule generator.
product

string

The product.
displayName

string

The display name.
vendor

string

The vendor.
sourceSystemName

string

The source system name.
originalName

string

The original name.
sourceSystemUrl

string

The source system URL.
sourceRuleIdentifier

string

The source rule identifier.

MinimalInvolvedEntity

Minimal information about an entity.

JSON representation 
{
  "entityType": string,
  "entityId": string,
  "isSuspicious": boolean,
  "threatSource": string,
  "operationSystem": string,
  "networkName": string,
  "networkPriority": integer,
  "isAttacker": boolean,
  "isPivot": boolean,
  "additionalProperties": {
    string: string,
    ...
  },
  "sourceSystemUrl": string
}
Fields
entityType

string

The entity type.
entityId

string

The entity identifier.
isSuspicious

boolean

Whether the entity is suspicious.
threatSource

string

The threat source.
operationSystem

string

The operation system.
networkName

string

The network name.
networkPriority

integer

The network priority.
isAttacker

boolean

Whether the entity is an attacker.
isPivot

boolean

Whether the entity is a pivot.
additionalProperties

map (key: string, value: string)

Additional properties.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
sourceSystemUrl

string

The source system URL.

MinimalInvolvedMappedEvent

Minimal information about a mapped event.

JSON representation 
{
  "product": string,
  "sourceSystemName": string,
  "rawFields": [
    {
      object (AgentPropertyValue)
    }
  ]
}
Fields
product

string

The product.
sourceSystemName

string

The source system name.
rawFields[]

object (AgentPropertyValue)

The raw fields.

AgentPropertyValue

A property value.

JSON representation 
{
  "key": string,
  "value": string
}
Fields
key

string

The key.
value

string

The value.