Method: legacyCases.executeManualAction

Full name: projects.locations.instances.legacyCases.executeManualAction

Executes a single action on specific entities scopes on selected alerts within a case. Supports predefined scopes or manual entity selection and records the action execution in the case wall.

HTTP request

POST https://{endpoint}/v1alpha/{name}/legacyCases:executeManualAction

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
name

string

Required. The resource name of the LegacyCase to retrieve. Format: projects/{project}/locations/{location}/instances/{instance}/LegacyCases

Request body

The request body contains data with the following structure:

JSON representation 
{
  "caseId": string,
  "targetEntities": [
    {
      object (LegacyCaseApiSecurityEntityDataModel)
    }
  ],
  "properties": {
    string: string,
    ...
  },
  "actionProvider": string,
  "actionName": string,
  "scope": string,
  "alertGroupIdentifiers": [
    string
  ],
  "executionScope": enum (ExecutionScope),
  "isPredefinedScope": boolean,
  "distinctDuplicateEntities": boolean
}
Fields
caseId

string (int64 format)

Required. CaseId is the ID of the case associated with the manual action.
targetEntities[]

object (LegacyCaseApiSecurityEntityDataModel)

Optional. TargetEntities is a list of entities targeted by the manual action.
properties

map (key: string, value: string)

Optional. Properties is a dictionary of properties associated with the manual action.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
actionProvider

string

Required. ActionProvider is the provider of the action.
actionName

string

Required. ActionName is the name of the action.
scope

string

Optional. Scope is the scope of the action.
alertGroupIdentifiers[]

string

Optional. AlertGroupIdentifiers is a list of identifiers for alert groups.
executionScope

enum (ExecutionScope)

Optional. Defines the execution scope of an action. If this field is not provided, it defaults to ALERT.
isPredefinedScope

boolean

Optional. IsPredefinedScope indicates if the scope is predefined.
distinctDuplicateEntities

boolean

Optional. DistinctDuplicateEntities indicates whether the action should be executed only once per unique entity, filtering out duplicates to avoid multiple executions on the same entity.

Response body

If successful, the response body contains an instance of ApiActionResultDataModel.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.legacyCases.runManualAction

For more information, see the IAM documentation.

ExecutionScope

Defines the scope for which an action is designed to be executed.

Enums
EXECUTION_SCOPE_UNSPECIFIED The scope is unspecified.
ALERT The action is attached to an alert.
CASE The action is attached to a case.