Method: legacyCases.executeManualAction

Full name: projects.locations.instances.legacyCases.executeManualAction

Executes a single action on specific entities scopes on selected alerts within a case. Supports predefined scopes or manual entity selection and records the action execution in the case wall.

HTTP request


POST https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{name}/legacyCases:executeManualAction

Path parameters

Parameters
name

string

Required. The resource name of the LegacyCase to retrieve. Format: projects/{project}/locations/{location}/instances/{instance}/LegacyCases

Request body

The request body contains data with the following structure:

JSON representation 
{
  "caseId": string,
  "targetEntities": [
    {
      object (LegacyCaseApiSecurityEntityDataModel)
    }
  ],
  "properties": {
    string: string,
    ...
  },
  "actionProvider": string,
  "actionName": string,
  "scope": string,
  "alertGroupIdentifiers": [
    string
  ],
  "isPredefinedScope": boolean
}
Fields
caseId

string (int64 format)

Required. CaseId is the ID of the case associated with the manual action.
targetEntities[]

object (LegacyCaseApiSecurityEntityDataModel)

Optional. TargetEntities is a list of entities targeted by the manual action.
properties

map (key: string, value: string)

Optional. Properties is a dictionary of properties associated with the manual action.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
actionProvider

string

Required. ActionProvider is the provider of the action.
actionName

string

Required. ActionName is the name of the action.
scope

string

Optional. Scope is the scope of the action.
alertGroupIdentifiers[]

string

Optional. AlertGroupIdentifiers is a list of identifiers for alert groups.
isPredefinedScope

boolean

Optional. IsPredefinedScope indicates if the scope is predefined.

Response body

If successful, the response body contains an instance of ApiActionResultDataModel.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.legacyCases.runManualAction

For more information, see the IAM documentation.