Method: legacy.legacyFetchUdmSearchView

Full name: projects.locations.instances.legacy.legacyFetchUdmSearchView

Legacy endpoint for fetching events, filters, and histograms matching UDM search.

HTTP request

POST https://{endpoint}/v1alpha/{instance}/legacy:legacyFetchUdmSearchView

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The name of the parent resource, which is the SecOps instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "baselineQuery": string,
  "snapshotQuery": string,
  "baselineTimeRange": {
    object (Interval)
  },
  "snapshotTimeRange": {
    object (Interval)
  },
  "eventList": {
    object (UdmEventListOptions)
  },
  "timeline": {
    object (EventCountTimelineOptions)
  },
  "fieldAggregations": {
    object (UdmFieldAggregationsOptions)
  },
  "caseInsensitive": boolean,
  "generateAiOverview": boolean,
  "returnOperationIdOnly": boolean,
  "detectionOptions": {
    object (DetectionOptions)
  },
  "statsFunctionParameter": {
    object (FunctionParameter)
  },
  "draftDataAccessScope": {
    object (DataAccessScope)
  },
  "prevalence": {
    object (UdmPrevalenceOptions)
  },
  "enablePocFastPath": boolean,
  "federationMetadata": {
    object (FederationMetadata)
  },
  "userSql": string
}
Fields
baselineQuery

string

Required. Boolean query to search for events. You can refer to https://cloud.google.com/chronicle/docs/investigation/udm-search for the query syntax. Example: 'ip=/172.*/ AND metadata.event_type!="NETWORK_CONNECTION" AND ( target.ip = "3.225.179.73" OR target.ip = "23.47.48.70")'
snapshotQuery

string

Query applied to the baseline query's events. In other words, this query is applied to the Snapshot produced from the baseline query. The snapshotQuery has the same syntax as baselineQuery and is implicitly ANDed with baselineQuery to produce events.
baselineTimeRange

object (Interval)

Required. Required, the time range to search for [inclusive start time, exclusive end time).
snapshotTimeRange

object (Interval)

The time range to filter for [inclusive start time, exclusive end time). This time range must be completely within baselineTimeRange. If not set, it is assumed to match baselineTimeRange.
eventList

object (UdmEventListOptions)

Parameters for the Events that will be streamed back.
timeline

object (EventCountTimelineOptions)

Parameters for the EventCountTimeline that will be streamed back.
fieldAggregations

object (UdmFieldAggregationsOptions)

Parameters for the Aggregated UDM fields that will be streamed back.
caseInsensitive

boolean

If true, the search should be performed in a case-insensitive manner.
generateAiOverview

boolean

Optional. If true, generate AI overview for the search results.
returnOperationIdOnly

boolean

Optional. If this field is set to true, the response will only contain the operation resource name. The actual search results (events) will be streamed back when the client invokes the streamSearchOperation method using this operation resource name.
detectionOptions

object (DetectionOptions)

Fetch alerts/detections relevant to the search result.
statsFunctionParameter

object (FunctionParameter)

The request to apply statistical function on filtered data.
draftDataAccessScope

object (DataAccessScope)

Data access scope used to filter events. This is intended to be used by admins to preview in-development scopes. Should only be called by users with global access. If the caller does not have global access, the request will fail.
prevalence

object (UdmPrevalenceOptions)

Parameters to get prevalence counts on Events returned by UDM Search
enablePocFastPath

boolean

If true, search will limit maxBaselineResults to 30K events and remove time-order guarantee (i.e., results may not be the most-recent events in baseline query time range). In this mode, replayed search queries are not guaranteed to yield the same results each time. This option is for poc use-cases only.
federationMetadata

object (FederationMetadata)

Optional. Federation metadata for the request. If this field is populated, it implied this is a federated search.
userSql

string

Optional. The user-provided SQL query to execute.

Response body

Depending on the parameters in ListUdmEventsV3Request, stream back some combination of UDM Events, EventCountTimeline, and UdmFieldAggregations.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "operation": string,
  "progress": number,
  "tooManyEvents": boolean,
  "tooLargeResponse": boolean,
  "complete": boolean,
  "validBaselineQuery": boolean,
  "baselineEventsCount": integer,
  "availableResultCount": integer,
  "validSnapshotQuery": boolean,
  "queryValidationErrors": [
    {
      object (ErrorMessage)
    }
  ],
  "runtimeErrors": [
    {
      object (RuntimeError)
    }
  ],
  "filteredEventsCount": integer,
  "joinAggregations": [
    {
      object (GroupAggregationByField)
    }
  ],
  "statsFunctionParameterValidationErrorMessage": string,
  "prevalence": {
    object (UdmPrevalenceResponse)
  },
  "stats": {
    object (Stats)
  },
  "dataSources": [
    enum (SearchDataSource)
  ],
  "aiOverview": {
    object (AIOverview)
  },
  "selectedFields": [
    string
  ],
  "unselectedFields": [
    string
  ],
  "baselineTimedEntitiesCount": integer,
  "filteredTimedEntitiesCount": integer,
  "degradedResponse": boolean,
  "events": {
    object (UdmEventList)
  },
  "timeline": {
    object (EventCountTimeline)
  },
  "fieldAggregations": {
    object (UdmFieldAggregations)
  },
  "udmEntityFieldAggregations": {
    object (UdmFieldAggregations)
  },
  "entityContextTypeFieldAggregations": {
    object (UdmFieldAggregations)
  },
  "groupedFieldAggregations": {
    object (UdmFieldAggregations)
  },
  "datatableAggregations": {
    object (UdmFieldAggregations)
  },
  "detections": {
    object (Detections)
  },
  "statsFunctionResponse": {
    object (FunctionResponse)
  },
  "statsResultAggregation": {
    object (UdmFieldAggregations)
  },
  "activityTimeline": {
    object (EventCountTimeline)
  },
  "columnSchema": {
    object (ColumnSchema)
  }
}
Fields
operation

string

The name of the operation resource representing the UDM Search operation. This can be passed to StreamSearchOperation to fetch stored results or stream the results of an in-progress operation.

The metadata type of the operation is UdmSearchMetadata. The response type is LegacyFetchUdmSearchViewResponse.

Format: projects/{project}/locations/{location}/instances/{instance}/operations/{operation}
progress

number

Progress of the query represented as a double between 0 and 1.
tooManyEvents

boolean

If true, there are too many events to return and some have been omitted.
tooLargeResponse

boolean

If true, the response to be returned to the UI is too large and some events have been omitted.
complete

boolean

Streaming for this response is done. There will be no additional updates.
validBaselineQuery

boolean

Indicates whether the request baselineQuery is a valid structured query or not. If not, queryValidationErrors will include the parse error.
baselineEventsCount

integer

The number of events in the baseline query.
availableResultCount

integer

The available number of results returned for the query. This field represents the actual number of events or rows returned in the fetch UDM search view response before any pagination is applied. This may vary from the baselineEventsCount or filteredEventsCount due to partial completion or trimmed results.
validSnapshotQuery

boolean

Indicates whether the request baseline and snapshot queries are valid. If not, queryValidationErrors will include the parse error.
queryValidationErrors[]

object (ErrorMessage)

Parse error for the baselineQuery and/or the snapshotQuery.
runtimeErrors[]

object (RuntimeError)

Runtime errors.
filteredEventsCount

integer

The number of events in the snapshot that match the snapshotQuery. This is <= baselineEventsCount. If the snapshot query is empty this will be equivalent to baselineEventsCount.
joinAggregations[]

object (GroupAggregationByField)

List of join aggregations for the join query.
statsFunctionParameterValidationErrorMessage

string

If the request's statsFunctionParameter` is invalid, this field will contain the detailed error message.
prevalence

object (UdmPrevalenceResponse)

Prevalence results on Events returned by UDM Search
stats

object (Stats)

Stats results when the query is for statistics
dataSources[]

enum (SearchDataSource)

Datasource of the query and results in case of a statistics query
aiOverview

object (AIOverview)

AI generated overview for the search results. Only populated if the AI features are enabled for the customer and generateAiOverview is set to true in the request.
selectedFields[]

string

Fields and variables that have been selected in the query.
unselectedFields[]

string

Fields and variables that have been unselected / excluded in the query.
baselineTimedEntitiesCount

integer

Output only. The number of timed entities in the baseline query.
filteredTimedEntitiesCount

integer

Output only. The number of events in the snapshot that match the snapshotQuery. This is <= baselineTimedEntitiesCount. If the snapshot query is empty this will be equivalent to baselineTimedEntitiesCount.
degradedResponse

boolean

Indicates degraded response sent to the client. Currently, this is set to true when memcache health check fails and we serve partial results from spanner.
events

object (UdmEventList)

List of UDM events. NOTE: After complete is set to true, the UdmEventList message will be omitted from the response. The latest message should be used as reference. If the UdmEventList message is returned again, then it should replace the previous value.
timeline

object (EventCountTimeline)

Timeline of event counts broken into buckets.
fieldAggregations

object (UdmFieldAggregations)

List of UDM fields with aggregated values.
udmEntityFieldAggregations

object (UdmFieldAggregations)

List of Entity fields with aggregated values.
entityContextTypeFieldAggregations

object (UdmFieldAggregations)

List of Entity fields aggregated by context type.
groupedFieldAggregations

object (UdmFieldAggregations)

List of grouped fields with aggregated values.
datatableAggregations

object (UdmFieldAggregations)

List of datatable fields with aggregated column values.
detections

object (Detections)

List of relevant detections, if detectionList.max_returned_detections was set.
statsFunctionResponse

object (FunctionResponse)

Result for statistical function.
statsResultAggregation

object (UdmFieldAggregations)

Optional. Lists stats results with aggregated values.
activityTimeline

object (EventCountTimeline)

Timeline of event counts broken into hourly/daily buckets to identify activity.
columnSchema

object (ColumnSchema)

Optional. Column schema for the results based on the query columns. This is used to provide metadata like data source, eventName etc.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.legacies.legacyFetchUdmSearchView

For more information, see the IAM documentation.

UdmEventListOptions

JSON representation 
{
  "maxReturnedEvents": integer
}
Fields
maxReturnedEvents

integer

EventCountTimelineOptions

This type has no fields.

UdmFieldAggregationsOptions

JSON representation 
{
  "maxValuesPerField": integer
}
Fields
maxValuesPerField

integer

DetectionOptions

JSON representation 
{
  "snapshotQuery": string,
  "detectionList": {
    object (DetectionListOptions)
  },
  "fieldAggregations": {
    object (UdmFieldAggregationsOptions)
  },
  "fetchNonAlertingDetections": boolean
}
Fields
snapshotQuery

string
detectionList

object (DetectionListOptions)
fieldAggregations

object (UdmFieldAggregationsOptions)
fetchNonAlertingDetections

boolean

DetectionListOptions

JSON representation 
{
  "maxReturnedDetections": integer
}
Fields
maxReturnedDetections

integer

FunctionParameter

JSON representation 
{
  "groupedFields": [
    {
      object (GroupByField)
    }
  ],
  "selectedFields": [
    {
      object (SelectedField)
    }
  ],
  "orders": [
    {
      object (OrderBy)
    }
  ],
  "maxReturnedRows": integer
}
Fields
groupedFields[]

object (GroupByField)
selectedFields[]

object (SelectedField)
orders[]

object (OrderBy)
maxReturnedRows

integer (uint32 format)

GroupByField

JSON representation 
{
  "udmFieldPath": string,
  "toLowerCase": boolean,

  // Union field transformation can be only one of the following:
  "resolutionInNanoSeconds": string,
  "cidrPrefixLengthInBits": integer,
  "topNLevelDomain": integer,
  "getRegisteredDomain": boolean
  // End of list of possible types for union field transformation.
}
Fields
udmFieldPath

string
toLowerCase

boolean

Union field transformation.

transformation can be only one of the following:
resolutionInNanoSeconds

string
cidrPrefixLengthInBits

integer (uint32 format)
topNLevelDomain

integer (uint32 format)
getRegisteredDomain

boolean

SelectedField

JSON representation 
{
  "udmFieldPath": string,
  "functionType": enum (FunctionType),
  "percentile": number
}
Fields
udmFieldPath

string
functionType

enum (FunctionType)
percentile

number

FunctionType

Enums
FUNCTION_TYPE_UNSPECIFIED
FUNCTION_TYPE_SUM
FUNCTION_TYPE_COUNT
FUNCTION_TYPE_COUNT_DISTINCT
FUNCTION_TYPE_AVERAGE
FUNCTION_TYPE_STDDEV
FUNCTION_TYPE_MIN
FUNCTION_TYPE_MAX

OrderBy

JSON representation 
{
  "fieldIndex": integer,
  "isDescendingOrder": boolean
}
Fields
fieldIndex

integer (uint32 format)
isDescendingOrder

boolean

UdmPrevalenceOptions

JSON representation 
{
  "getPrevalence": boolean,
  "bucketSize": {
    object (UdmSearchAggregationBucketFunction)
  }
}
Fields
getPrevalence

boolean
bucketSize

object (UdmSearchAggregationBucketFunction)

UdmSearchAggregationBucketFunction

JSON representation 
{
  "resolutionInSeconds": integer
}
Fields
resolutionInSeconds

integer

FederationMetadata

Federation metadata definition. UI will use this to provide information about the instance and instance groups on which federated search is to be performed.

JSON representation 
{
  "instances": [
    {
      object (InstanceSelection)
    }
  ],
  "federationGroups": [
    {
      object (FederationGroupSelection)
    }
  ]
}
Fields
instances[]

object (InstanceSelection)

Optional. List of instances on which federated search request is being made.
federationGroups[]

object (FederationGroupSelection)

Optional. List of instance groups on which federated search request is being made.

InstanceSelection

Chronicle instance on which federated search request is being made.

JSON representation 
{
  "instance": string
}
Fields
instance

string

Required. Chronicle instance name on which federated search request is being made. Format: projects/{project}/locations/{location}/instances/{instance}

FederationGroupSelection

Chronicle federation group on which federated search request is being made.

JSON representation 
{
  "federationGroup": string
}
Fields
federationGroup

string

Optional. Resource name of the Federation Group. Format: projects/{project}/locations/{location}/instances/{instance}/federationGroups/{federationGroup}

UdmEventList

JSON representation 
{
  "events": [
    {
      object (UdmEventInfo)
    }
  ],
  "columnNames": {
    object (ColumnNames)
  },
  "progress": number,
  "tooManyEvents": boolean,
  "complete": boolean,
  "datatableInfo": [
    {
      object (SearchDataTableInfo)
    }
  ],
  "rows": [
    {
      object (ResultRow)
    }
  ]
}
Fields
events[]

object (UdmEventInfo)
columnNames

object (ColumnNames)
progress

number
tooManyEvents

boolean
complete

boolean
datatableInfo[]

object (SearchDataTableInfo)
rows[]

object (ResultRow)

ColumnNames

JSON representation 
{
  "names": [
    string
  ]
}
Fields
names[]

string

SearchDataTableInfo

JSON representation 
{
  "dataTable": string,
  "columnInfo": [
    {
      object (SearchDataTableColumnInfo)
    }
  ]
}
Fields
dataTable

string
columnInfo[]

object (SearchDataTableColumnInfo)

SearchDataTableColumnInfo

JSON representation 
{
  "originalColumn": string,
  "isDefault": boolean
}
Fields
originalColumn

string
isDefault

boolean

ResultRow

JSON representation 
{
  "outcomes": [
    {
      object (UdmColumnType)
    }
  ],
  "id": string,
  "placerRowInfo": {
    object (PlacerRowInfo)
  },

  // Union field result can be only one of the following:
  "event": {
    object (EventRecord)
  },
  "entity": {
    object (EntityContextRecord)
  },
  "join": {
    object (JoinRecord)
  },
  "detection": {
    object (DetectionRecord)
  },
  "stats": {
    object (SearchStatsRecord)
  },
  "dataTable": {
    object (SearchDataTableRecord)
  },
  "caseDetails": {
    object (CaseRecord)
  },
  "caseHistory": {
    object (CaseHistoryRecord)
  }
  // End of list of possible types for union field result.
}
Fields
outcomes[]

object (UdmColumnType)
id

string
placerRowInfo

object (PlacerRowInfo)

Union field result.

result can be only one of the following:
event

object (EventRecord)
entity

object (EntityContextRecord)
join

object (JoinRecord)
detection

object (DetectionRecord)
stats

object (SearchStatsRecord)
dataTable

object (SearchDataTableRecord)
caseDetails

object (CaseRecord)
caseHistory

object (CaseHistoryRecord)

EventRecord

JSON representation 
{
  "event": {
    object (UDM)
  },
  "eventLogToken": string,
  "alertNumber": integer,
  "alertViewId": string,
  "annotations": [
    enum (Annotation)
  ],
  "detections": [
    {
      object (Collection)
    }
  ],
  "table": string,
  "tenantId": string
}
Fields
event

object (UDM)
eventLogToken

string (bytes format)

A base64-encoded string.
alertNumber

integer
alertViewId

string (bytes format)

A base64-encoded string.
annotations[]

enum (Annotation)
detections[]

object (Collection)
table

string
tenantId

string

Optional.

Annotation

Enums
ANNOTATION_UNSPECIFIED
ANNOTATION_ALERT

EntityContextRecord

JSON representation 
{
  "entity": {
    object (Entity)
  },
  "eventLogToken": string,
  "timed": boolean,
  "connectedComponentLabel": string,
  "detections": [
    {
      object (Collection)
    }
  ],
  "table": string,
  "idAndPath": {
    object (IdAndPath)
  },
  "tenantId": string
}
Fields
entity

object (Entity)
eventLogToken

string
timed

boolean
connectedComponentLabel

string (bytes format)

Optional.

A base64-encoded string.
detections[]

object (Collection)
table

string
idAndPath

object (IdAndPath)
tenantId

string

Optional.

JoinRecord

JSON representation 
{
  "events": [
    {
      object (EventRecord)
    }
  ],
  "entities": [
    {
      object (EntityContextRecord)
    }
  ],
  "dataTables": [
    {
      object (SearchDataTableRecord)
    }
  ]
}
Fields
events[]

object (EventRecord)
entities[]

object (EntityContextRecord)
dataTables[]

object (SearchDataTableRecord)

SearchDataTableRecord

JSON representation 
{
  "dataTable": string,
  "rowData": [
    {
      object (SearchDataTableRowData)
    }
  ]
}
Fields
dataTable

string
rowData[]

object (SearchDataTableRowData)

SearchDataTableRowData

JSON representation 
{
  "column": string,
  "value": string
}
Fields
column

string
value

string

DetectionRecord

JSON representation 
{
  "id": string,
  "collection": {
    object (Collection)
  }
}
Fields
id

string (bytes format)

A base64-encoded string.
collection

object (Collection)

SearchStatsRecord

JSON representation 
{
  "results": [
    {
      object (SearchStatsColumnData)
    }
  ]
}
Fields
results[]

object (SearchStatsColumnData)

SearchStatsColumnData

JSON representation 
{
  "column": string,
  "values": {
    object (UdmColumnType)
  }
}
Fields
column

string
values

object (UdmColumnType)

CaseRecord

JSON representation 
{
  "soarCase": {
    object (Case)
  }
}
Fields
soarCase

object (Case)

Case

Case is a representation of a SOAR case. NEXT TAG: 36

JSON representation 
{
  "name": string,
  "displayName": string,
  "stage": string,
  "priority": enum (Priority),
  "status": enum (SoarCaseDataStatus),
  "responsePlatformInfo": {
    object (ResourceResponsePlatformInfo)
  },
  "environment": string,
  "assignee": {
    object (SoarUser)
  },
  "important": boolean,
  "incident": boolean,
  "createTime": string,
  "updateTime": string,
  "closureDetails": {
    object (SoarCaseClosureDetails)
  },
  "tags": [
    {
      object (SoarCaseTag)
    }
  ],
  "tasks": [
    {
      object (SoarTask)
    }
  ],
  "wallActivities": [
    {
      object (SoarWallActivity)
    }
  ],
  "alerts": [
    {
      object (AlertWithEntities)
    }
  ],
  "overflowCase": boolean,
  "type": enum (SoarCaseType),
  "source": string,
  "description": string,
  "score": number,
  "creatorUser": {
    object (SoarUser)
  },
  "lastModifyingUser": {
    object (SoarUser)
  },
  "customFields": {
    string: {
      object (ExternalCustomField)
    },
    ...
  }
}
Fields
name

string

A unique identifier (GUID) for the SOAR case.
displayName

string

Display name of the Case.
stage

string

The current stage or phase of the case workflow. Limited set of values but users can define custom values.
priority

enum (Priority)

The priority of the case.
status

enum (SoarCaseDataStatus)

The current status of the case.
responsePlatformInfo

object (ResourceResponsePlatformInfo)

Response Platform information.
environment

string

SOAR Environments associated to this case.
assignee

object (SoarUser)

The username (if assigned to a user) or role name (if assigned to a role) of the assignee.
important

boolean

Indicates whether the case is marked as important.
incident

boolean

Indicates whether the case is classified as an incident.
createTime

string (Timestamp format)

The timestamp when the case was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

The timestamp when the case was last modified.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
closureDetails

object (SoarCaseClosureDetails)

The closure details of the case if it is closed.
tags[]

object (SoarCaseTag)

The tags associated with the case.
tasks[]

object (SoarTask)

The taks associated with the case.
wallActivities[]

object (SoarWallActivity)

The wall activities associated with the case.
alerts[]

object (AlertWithEntities)

The alerts associated with the case.
overflowCase

boolean

Indicates whether the case is an overflow case (exceeded capacity).
type

enum (SoarCaseType)

The type of the case.
source

string

The source of the case.
description

string

The description of the case.
score

number

Attack exposure score, how risky the case
creatorUser

object (SoarUser)

The user who created the case.
lastModifyingUser

object (SoarUser)

The user who last modified the case.
customFields

map (key: string, value: object (ExternalCustomField))

A list of custom fields associated with the case.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

SoarCaseDataStatus

Enums
SOAR_CASE_DATA_STATUS_UNSPECIFIED
OPENED
CLOSED
ALL
MERGED
CREATION_PENDING

ResourceResponsePlatformInfo

Related info of an entity in customer's SOAR platform.

JSON representation 
{
  "responsePlatformType": enum (ResponsePlatformType),
  "responsePlatformId": string
}
Fields
responsePlatformType

enum (ResponsePlatformType)

Type of SOAR product.
responsePlatformId

string

Id of the resource in SOAR product.

SoarUser

JSON representation 
{
  "name": string,
  "givenName": string,
  "familyName": string,
  "email": string,
  "lastLoginTime": string,
  "environments": [
    string
  ],
  "deleted": boolean,
  "socRoles": [
    string
  ]
}
Fields
name

string
givenName

string
familyName

string
email

string
lastLoginTime

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
environments[]

string
deleted

boolean
socRoles[]

string

SoarCaseClosureDetails

JSON representation 
{
  "reason": enum (SoarCaseCloseReason),
  "rootCause": string,
  "caseClosedAction": enum (SoarCaseClosedAction)
}
Fields
reason

enum (SoarCaseCloseReason)
rootCause

string
caseClosedAction

enum (SoarCaseClosedAction)

SoarCaseCloseReason

Enums
SOAR_CASE_CLOSE_REASON_UNSPECIFIED
MALICIOUS
NOT_MALICIOUS
MAINTENANCE
INCONCLUSIVE
UNKNOWN

SoarCaseClosedAction

Enums
SOAR_CASE_CLOSED_ACTION_UNSPECIFIED
AUTOMATIC
MANUALLY

SoarCaseTag

SoarCaseTag is a representation of a SOAR case tag. NEXT TAG: 3

JSON representation 
{
  "name": string,
  "createTime": string
}
Fields
name

string

The name of the tag.
createTime

string (Timestamp format)

The creation time of the tag.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SoarTask

SoarTask is a representation of a SOAR task. NEXT TAG: 15

JSON representation 
{
  "name": string,
  "author": {
    object (SoarUser)
  },
  "assignee": {
    object (SoarUser)
  },
  "resolver": {
    object (SoarUser)
  },
  "createTime": string,
  "updateTime": string,
  "dueTime": string,
  "resolutionTime": string,
  "title": string,
  "content": string,
  "favorite": boolean,
  "status": enum (SoarTaskStatus)
}
Fields
name

string

A unique identifier for the SOAR task.
author

object (SoarUser)

The user who created the task.
assignee

object (SoarUser)

The user who is assigned the task.
resolver

object (SoarUser)

The user who resolved the task.
createTime

string (Timestamp format)

The timestamp when the task was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

The last update time of the task.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dueTime

string (Timestamp format)

The due time of the task.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
resolutionTime

string (Timestamp format)

The resolution time of the task in milliseconds.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
title

string

The title of the task.
content

string

The content of the task.
favorite

boolean

Indicates if the task is a favorite.
status

enum (SoarTaskStatus)

The status of the task.

SoarTaskStatus

Enums
SOAR_TASK_STATUS_UNSPECIFIED
PENDING
COMPLETED

SoarWallActivity

SoarWallActivity is a representation of a SOAR case wall activity. NEXT TAG: 8

JSON representation 
{
  "name": string,
  "title": string,
  "activityType": enum (SoarWallActivityType),
  "activityData": string,
  "createTime": string,
  "creator": {
    object (SoarUser)
  }
}
Fields
name

string

The unique identifier(GUID) for the case wall activity.
title

string

The title of the activity.
activityType

enum (SoarWallActivityType)

The case wall activity type.
activityData

string

The data of the activity.
createTime

string (Timestamp format)

The creation time of the activity.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
creator

object (SoarUser)

The user who created the activity.

SoarWallActivityType

Enums
SOAR_WALL_ACTIVITY_TYPE_UNSPECIFIED
CASE_ALERT_DATA
CASE_STATUS_CHANGE
CASE_TASK
CASE_ACTION
CASE_EVIDENCE
CASE_COMMENT
CASE_INSIGHT
CASE_CREATION
CASE_EXTERNAL_CHANNEL_MESSAGE
PINNED_CASE_CHAT_MESSAGE

AlertWithEntities

The alert metadata and associated entities.

JSON representation 
{
  "metadata": {
    object (Collection)
  },
  "entities": [
    {
      object (SoarInvolvedEntity)
    }
  ],
  "customFields": {
    string: {
      object (ExternalCustomField)
    },
    ...
  }
}
Fields
metadata

object (Collection)

The alert metadata.
entities[]

object (SoarInvolvedEntity)

The entities associated with the alert.
customFields

map (key: string, value: object (ExternalCustomField))

The custom fields associated with the alert.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

SoarInvolvedEntity

JSON representation 
{
  "name": string,
  "identifier": string,
  "type": string,
  "suspicious": boolean,
  "internal": boolean,
  "threatSource": string,
  "operatingSystem": string,
  "networkName": string,
  "networkPriority": integer,
  "attacker": boolean,
  "pivot": boolean,
  "environment": string,
  "manuallyCreated": boolean,
  "additionalProperties": string,
  "sourceSystemUri": string,
  "enriched": boolean,
  "artifact": boolean,
  "vulnerable": boolean,
  "entityUri": string,
  "fields": [
    {
      object (SoarContextGroup)
    }
  ],
  "caseMetadata": {
    object (CaseMetadata)
  }
}
Fields
name

string
identifier

string
type

string
suspicious

boolean
internal

boolean
threatSource

string
operatingSystem

string
networkName

string
networkPriority

integer
attacker

boolean
pivot

boolean
environment

string
manuallyCreated

boolean
additionalProperties

string
sourceSystemUri

string
enriched

boolean
artifact

boolean
vulnerable

boolean
entityUri

string
fields[]

object (SoarContextGroup)
caseMetadata

object (CaseMetadata)

SoarContextGroup

JSON representation 
{
  "displayName": string,
  "highlighted": boolean,
  "hidden": boolean,
  "items": [
    {
      object (SoarContextGroupItem)
    }
  ]
}
Fields
displayName

string
highlighted

boolean
hidden

boolean
items[]

object (SoarContextGroupItem)

SoarContextGroupItem

JSON representation 
{
  "name": string,
  "originalName": string,
  "value": string
}
Fields
name

string
originalName

string
value

string

CaseMetadata

JSON representation 
{
  "caseId": string,
  "responsePlatformType": enum (ResponsePlatformType)
}
Fields
caseId

string
responsePlatformType

enum (ResponsePlatformType)

ResponsePlatformType

Enums
RESPONSE_PLATFORM_TYPE_UNSPECIFIED
RESPONSE_PLATFORM_TYPE_SIEMPLIFY

ExternalCustomField

JSON representation 
{

  // Union field kind can be only one of the following:
  "stringSeq": {
    object (StringSequence)
  },
  "timeVal": string
  // End of list of possible types for union field kind.
}
Fields

Union field kind.

kind can be only one of the following:
stringSeq

object (StringSequence)
timeVal

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

SoarCaseType

Enums
SOAR_CASE_TYPE_UNSPECIFIED
EXTERNAL
TEST
REQUEST

CaseHistoryRecord

JSON representation 
{
  "soarCaseHistory": {
    object (SoarCaseHistory)
  }
}
Fields
soarCaseHistory

object (SoarCaseHistory)

SoarCaseHistory

SoarCaseHistory is a representation of the history of a SOAR case updates. NEXT TAG: 15

JSON representation 
{
  "name": string,
  "caseResponsePlatformInfo": {
    object (CaseMetadata)
  },
  "eventTime": string,
  "stage": string,
  "assignee": {
    object (SoarUser)
  },
  "priority": enum (Priority),
  "status": enum (SoarCaseDataStatus),
  "incident": boolean,
  "important": boolean,
  "slaType": enum (SoarCaseHistorySLAType),
  "caseActivity": enum (SoarCaseHistoryActivityType),
  "agentInvestigationState": enum (AgentInvestigationState),
  "alertCount": string
}
Fields
name

string

A unique identifier (GUID) for the SOAR case history.
caseResponsePlatformInfo

object (CaseMetadata)

The case response platform info.
eventTime

string (Timestamp format)

The timestamp when the event occurred.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
stage

string

The new stage of the case after the event.
assignee

object (SoarUser)

The new assignee of the case after the event.
priority

enum (Priority)

The priority of the case after the event.
status

enum (SoarCaseDataStatus)

The status of the case after the event.
incident

boolean

Whether the case is marked as an incident after the event.
important

boolean

Whether the case is marked as important after the event.
slaType

enum (SoarCaseHistorySLAType)

The type of SLA that was exceeded.
caseActivity

enum (SoarCaseHistoryActivityType)

The type of activity that occurred (e.g., stage change, assignee change, case creation).
agentInvestigationState

enum (AgentInvestigationState)

Output only. Captures the investigation state of the case.
alertCount

string (int64 format)

Output only. The number of alerts associated with the case.

SoarCaseHistorySLAType

Enums
SOAR_CASE_HISTORY_SLA_TYPE_UNSPECIFIED
CASE_SLA
ALERT_SLA
STAGE_SLA

SoarCaseHistoryActivityType

Enums
SOAR_CASE_HISTORY_ACTIVITY_TYPE_UNSPECIFIED
STAGE_CHANGE
ASSIGNEE_CHANGE
CREATE_CASE
PRIORITY_CHANGE
CLOSE_CASE
REOPEN_CASE
MARK_INCIDENT
MARK_IMPORTANT
EXCEEDED_SLA

AgentInvestigationState

The investigation state of the case.

Enums
AGENT_INVESTIGATION_STATE_UNSPECIFIED This value is used to indicate that the investigation state is not set.
AGENT_INVESTIGATED The agent has investigated some alerts in the case but not all of them.
ALL_ALERTS_INVESTIGATED All alerts in the case were investigated.

EventCountTimeline

JSON representation 
{
  "buckets": [
    {
      object (EventCountTimelineBucket)
    }
  ],
  "sizeOfBucketMs": string
}
Fields
buckets[]

object (EventCountTimelineBucket)
sizeOfBucketMs

string (int64 format)

EventCountTimelineBucket

JSON representation 
{
  "baselineEventCount": integer,
  "eventCount": integer,
  "baselineAlertCount": integer,
  "alertCount": integer,
  "baselineTimedEntityCount": integer,
  "filteredTimedEntityCount": integer,
  "entityChangedCount": {
    object (EntityChangedCountTimelineBucket)
  },
  "joinsResultCount": [
    {
      object (JoinsResultCountTimelineBucket)
    }
  ]
}
Fields
baselineEventCount

integer
eventCount

integer
baselineAlertCount

integer
alertCount

integer
baselineTimedEntityCount

integer
filteredTimedEntityCount

integer
entityChangedCount

object (EntityChangedCountTimelineBucket)
joinsResultCount[]

object (JoinsResultCountTimelineBucket)

EntityChangedCountTimelineBucket

JSON representation 
{
  "totalChangedEntitiesCount": integer,
  "entityChangedInfo": [
    {
      object (EntityChangedInfo)
    }
  ]
}
Fields
totalChangedEntitiesCount

integer
entityChangedInfo[]

object (EntityChangedInfo)

EntityChangedInfo

JSON representation 
{
  "artifacts": {
    object (FieldAndValue)
  },
  "entityCount": integer
}
Fields
artifacts

object (FieldAndValue)
entityCount

integer

FieldAndValue

JSON representation 
{
  "value": string,
  "entityNamespace": string,

  // Union field type can be only one of the following:
  "fieldPath": string,
  "kvalueType": enum (KValueType)
  // End of list of possible types for union field type.
}
Fields
value

string
entityNamespace

string

Union field type.

type can be only one of the following:
fieldPath

string
kvalueType

enum (KValueType)

KValueType

Enums
UNKNOWN
COLLECTOR_ID
EVENT_SHARD
ASSET_IP_ADDRESS
MAC
HOSTNAME
PRODUCT_SPECIFIC_ID
NAMESPACE
DOMAIN_NAME
RESOLVED_IP_ADDRESS
STEMMED_DOMAIN_NAME
PROCESS_ID
FULL_COMMAND_LINE
FILE_NAME
FILE_PATH
HASH_MD5
HASH_SHA256
HASH_SHA1
RAW_PID
PARENT_PROCESS_ID
EMAIL
USERNAME
WINDOWS_SID
EMPLOYEE_ID
PRODUCT_OBJECT_ID
USER_DISPLAY_NAME
CLOUD_RESOURCE_NAME
REGISTRY_KEY
REGISTRY_VALUE_DATA
REGISTRY_VALUE_NAME
CIDR_BLOCK

JoinsResultCountTimelineBucket

JSON representation 
{
  "tableType": enum (TableType),
  "table": string,
  "baselineCount": integer,
  "filteredCount": integer
}
Fields
tableType

enum (TableType)
table

string
baselineCount

integer
filteredCount

integer

TableType

Enums
TABLE_TYPE_UNSPECIFIED
TABLE_TYPE_EVENT
TABLE_TYPE_ENTITY

UdmFieldAggregations

JSON representation 
{
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "groupByFields": [
    {
      object (GroupAggregationByField)
    }
  ],
  "complete": boolean
}
Fields
fields[]

object (UdmFieldAggregation)
groupByFields[]

object (GroupAggregationByField)
complete

boolean

UdmFieldAggregation

JSON representation 
{
  "fieldName": string,
  "baselineEventCount": integer,
  "eventCount": integer,
  "tooManyValues": boolean,
  "valueCount": integer,
  "allValues": [
    {
      object (UdmValueCount)
    }
  ],
  "topValues": [
    {
      object (UdmValueCount)
    }
  ],
  "bottomValues": [
    {
      object (UdmValueCount)
    }
  ],
  "aggregationType": enum (UdmFieldAggregationType)
}
Fields
fieldName

string
baselineEventCount

integer
eventCount

integer
tooManyValues

boolean
valueCount

integer
allValues[]

object (UdmValueCount)
topValues[]

object (UdmValueCount)
bottomValues[]

object (UdmValueCount)
aggregationType

enum (UdmFieldAggregationType)

UdmValueCount

JSON representation 
{
  "value": {
    object (UdmFieldValue)
  },
  "baselineEventCount": integer,
  "eventCount": integer
}
Fields
value

object (UdmFieldValue)
baselineEventCount

integer
eventCount

integer

UdmFieldValue

JSON representation 
{

  // Union field value can be only one of the following:
  "stringValue": string,
  "int32Value": integer,
  "uint32Value": integer,
  "int64Value": string,
  "uint64Value": string,
  "floatValue": number,
  "doubleValue": number,
  "enumValue": string,
  "boolValue": boolean,
  "bytesValue": string,
  "isNull": boolean,
  "timestampValue": string
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:
stringValue

string
int32Value

integer
uint32Value

integer (uint32 format)
int64Value

string (int64 format)
uint64Value

string
floatValue

number
doubleValue

number
enumValue

string
boolValue

boolean
bytesValue

string (bytes format)

A base64-encoded string.
isNull

boolean
timestampValue

string (Timestamp format)

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

UdmFieldAggregationType

Enums
UNSPECIFIED_FIELD_AGGREGATION_TYPE
UDM_FIELD_AGGREGATION_TYPE
ENTITY_FIELD_AGGREGATION_TYPE
DATA_TABLE_FIELD_AGGREGATION_TYPE
JOINS_FIELD_AGGREGATION_TYPE
DETECTION_FIELD_AGGREGATION_TYPE
CASE_FIELD_AGGREGATION_TYPE
CASE_HISTORY_FIELD_AGGREGATION_TYPE

GroupAggregationByField

JSON representation 
{
  "fieldName": string,
  "fieldValue": {
    object (UdmFieldValue)
  },
  "fields": [
    {
      object (UdmFieldAggregation)
    }
  ],
  "baselineEventCount": integer,
  "eventCount": integer,
  "valueCount": integer
}
Fields
fieldName

string
fieldValue

object (UdmFieldValue)
fields[]

object (UdmFieldAggregation)
baselineEventCount

integer
eventCount

integer
valueCount

integer

Detections

JSON representation 
{
  "detections": [
    {
      object (Collection)
    }
  ],
  "complete": boolean,
  "tooManyDetections": boolean,
  "validSnapshotQuery": boolean,
  "baselineAlertsCount": integer,
  "filteredAlertsCount": integer,
  "detectionFieldAggregations": {
    object (AlertFieldAggregations)
  }
}
Fields
detections[]

object (Collection)
complete

boolean
tooManyDetections

boolean
validSnapshotQuery

boolean
baselineAlertsCount

integer
filteredAlertsCount

integer
detectionFieldAggregations

object (AlertFieldAggregations)

FunctionResponse

JSON representation 
{
  "rows": [
    {
      object (FunctionResponseRow)
    }
  ],
  "tooManyRows": boolean
}
Fields
rows[]

object (FunctionResponseRow)
tooManyRows

boolean

FunctionResponseRow

JSON representation 
{
  "values": [
    {
      object (UdmFieldValue)
    }
  ]
}
Fields
values[]

object (UdmFieldValue)

UdmPrevalenceResponse

JSON representation 
{
  "buckets": [
    {
      object (UdmPrevalenceBucket)
    }
  ],
  "partialPrevalence": boolean,
  "bucketSizeSeconds": integer
}
Fields
buckets[]

object (UdmPrevalenceBucket)
partialPrevalence

boolean
bucketSizeSeconds

integer

UdmPrevalenceBucket

JSON representation 
{
  "prevalence": [
    {
      object (UdmPrevalence)
    }
  ],
  "timeRange": {
    object (Interval)
  }
}
Fields
prevalence[]

object (UdmPrevalence)
timeRange

object (Interval)

UdmPrevalence

JSON representation 
{
  "artifacts": [
    {
      object (FieldAndValue)
    }
  ],
  "prevalence": integer,
  "isFirstSeen": boolean
}
Fields
artifacts[]

object (FieldAndValue)
prevalence

integer
isFirstSeen

boolean

Stats

Stats results when the query is for statistics

JSON representation 
{
  "results": [
    {
      object (ColumnData)
    }
  ],
  "dataQueryExpression": string,
  "tooManyResults": boolean,
  "totalResults": integer,
  "filteredResultCount": integer,
  "sortOrder": [
    {
      object (ColumnSort)
    }
  ],
  "hasJoin": boolean,
  "hasDataTable": boolean,
  "pivotable": boolean
}
Fields
results[]

object (ColumnData)

Result rows that are queried.
dataQueryExpression

string

Expression that represent the subset of the requested query used to filter data. The expression will be used to enable features such as drill-down from stats results to UDM events. In that case, the new query will be composed by this expression and the expression related to a stats result.
tooManyResults

boolean

If true, there are too many results to return and some have been omitted.
totalResults

integer

The total number of results returned.
filteredResultCount

integer

The number of results returned after filtering. This is <= totalResults. If the snapshot query is empty this will be equivalent to totalResults.
sortOrder[]

object (ColumnSort)

Indicates the columns used for sorting and the order in which they are sorted. If no ORDER section is specified in the query, this will be empty.
hasJoin

boolean

Indicates to the frontend that the result is a join-stats result.
hasDataTable

boolean

Indicates to the frontend that the result contains a data-table.
pivotable

boolean

Indicates to the frontend that the result is pivotable to a non-stats query. This is used to determine whether to show the "Apply to baseline" and the "Run UDM Search" buttons. This is true when the data source supports both stats and non-stats queries.

ColumnData

Represents a single column in the set of columns returned as the stats query result.

JSON representation 
{
  "column": string,
  "values": [
    {
      object (ColumnType)
    }
  ],
  "filterable": boolean,
  "filterExpression": string,
  "columnMetadata": {
    object (ColumnMetadata)
  }
}
Fields
column

string

Used to store column names.
values[]

object (ColumnType)

To store store column data.
filterable

boolean

To identify if the column can be used for filtering/drill-downs.
filterExpression

string

Expression used to compose a query for filtering/drill-downs related to the data in this column.
columnMetadata

object (ColumnMetadata)

Metadata for the column.

ColumnType

Singular vs list of values in a column.

JSON representation 
{

  // Union field type can be only one of the following:
  "value": {
    object (ColumnValue)
  },
  "list": {
    object (List)
  }
  // End of list of possible types for union field type.
}
Fields

Union field type.

type can be only one of the following:
value

object (ColumnValue)

Single value in a column.
list

object (List)

List of values in a column e.g. IPs

ColumnValue

Value of the column based on data type

JSON representation 
{

  // Union field value can be only one of the following:
  "nullVal": boolean,
  "boolVal": boolean,
  "bytesVal": string,
  "doubleVal": number,
  "int64Val": string,
  "uint64Val": string,
  "stringVal": string,
  "timestampVal": string,
  "dateVal": {
    object (Date)
  },
  "protoVal": {
    "@type": string,
    field1: ...,
    ...
  }
  // End of list of possible types for union field value.
}
Fields

Union field value.

value can be only one of the following:
nullVal

boolean

True if the value is NULL.
boolVal

boolean

Boolean value.
bytesVal

string (bytes format)

Bytes value.

A base64-encoded string.
doubleVal

number

Double value.
int64Val

string (int64 format)

Integer value (signed).
uint64Val

string

Un-signed integer value.
stringVal

string

String value. Enum values are returned as strings.
timestampVal

string (Timestamp format)

Timestamp values.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dateVal

object (Date)

Date values.
protoVal

object

For any proto values that are not any of the above.

An object containing fields of an arbitrary type. An additional field "@type" contains a URI identifying the type. Example: { "id": 1234, "@type": "types.example.com/standard/id" }.

List

Store list of values in a column.

JSON representation 
{
  "values": [
    {
      object (ColumnValue)
    }
  ]
}
Fields
values[]

object (ColumnValue)

List of values in one cell of the column.

ColumnMetadata

Metadata for a column.

JSON representation 
{
  "column": string,
  "fieldPath": string,
  "functionNameUsed": string,
  "functionModule": string,
  "longitude": boolean,
  "latitude": boolean,
  "table": string,
  "timestampMetadata": {
    object (TimestampMetadata)
  }
}
Fields
column

string

Name of the column.
fieldPath

string

Field path of the column. eg: "udm.principal.hostname"
functionNameUsed

string

Function name of the column. eg: "ARRAY_IGNORE_NULLS_LIMIT", this corresponds to array function.
functionModule

string

Module name of the column.
longitude

boolean

Whether the column is a longitude field.
latitude

boolean

Whether the column is a latitude field.
table

string

Table name associated with the column to qualify column names for UI filters, e.g., to map an outcome like "$hostname" to "$e1.principal.hostname". Essential for disambiguating fields in match-based joins. This field will store e1, e2 etc (associated table for the column)
timestampMetadata

object (TimestampMetadata)

Timestamp Metadata

TimestampMetadata

Metadata for timestamp.

JSON representation 
{
  "timeFormat": string,
  "timeZone": string,
  "timeGranularity": string,
  "isSortable": boolean,
  "isInterpolable": boolean
}
Fields
timeFormat

string

Format of the timestamp.
timeZone

string

Time zone of the timestamp.
timeGranularity

string

Time granularity of the timestamp.
isSortable

boolean

Whether the timestamp is sortable.
isInterpolable

boolean

Whether the timestamp is interpolable.

ColumnSort

Contains the column name and which direction the column is sorted (ascending or descenging).

JSON representation 
{
  "name": string,
  "descending": boolean
}
Fields
name

string

Name of the column.
descending

boolean

Whether the column is sorted in descending order (ascending by default);

SearchDataSource

Data source for stats results in LegacyFetchUdmSearchViewResponse Equivalent to dashboard API

Enums
SEARCH_DATA_SOURCE_UNSPECIFIED Unspecified data source.
SEARCH_UDM Events
SEARCH_ENTITY Entities
SEARCH_RULE_DETECTIONS To be used for detections data source.
SEARCH_RULESETS To be used for ruleset with detections datasource.

AIOverview

AI generated overview for the search results.

JSON representation 
{
  "aiSummary": string,
  "suggestions": [
    {
      object (Action)
    }
  ],
  "complete": boolean
}
Fields
aiSummary

string

AI summary for the search results. Markdown formatted.
suggestions[]

object (Action)

Suggested actions to continue the investigation in chat.
complete

boolean

Whether AI overview generation is complete.

ColumnSchema

JSON representation 
{
  "metadata": [
    {
      object (TableMetadata)
    }
  ]
}
Fields
metadata[]

object (TableMetadata)

TableMetadata

JSON representation 
{
  "table": string,
  "dataSource": enum (DataSource),
  "index": integer
}
Fields
table

string
dataSource

enum (DataSource)
index

integer

DataSource

Enums
DATA_SOURCE_UNSPECIFIED
NORMALIZED_UDM_EVENTS
ENTITY_EVENTS
DATA_TABLE