Method: legacyCases.simulateAlert

Full name: projects.locations.instances.legacyCases.simulateAlert

Simulate a specific alert within a case in your environment (the alert is then presented as a Test case in your case queue).

HTTP request


POST https://chronicle.us.rep.googleapis.com/v1alpha/{name}/legacyCases:simulateAlert

Path parameters

Parameters
name

string

Required. The resource name of the LegacyCase to retrieve. Format: projects/{project}/locations/{location}/instances/{instance}/LegacyCases

Request body

The request body contains data with the following structure:

JSON representation 
{
  "caseId": string,
  "alertIdentifier": string,
  "environment": string,
  "fieldsToReplace": {
    string: string,
    ...
  },
  "shouldDoGrouping": boolean
}
Fields
caseId

string (int64 format)

Required. CaseId is the unique identifier of the case.
alertIdentifier

string

Required. AlertIdentifier is the identifier of the alert.
environment

string

Optional. Environment is the environment for the simulation.
fieldsToReplace

map (key: string, value: string)

Optional. FieldsToReplace is a map of fields to replace.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
shouldDoGrouping

boolean

Optional. ShouldDoGrouping indicates whether grouping should be performed.

Response body

If successful, the response body is an empty JSON object.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.legacyCases.ingestAlertTestCase

For more information, see the IAM documentation.