Method: legacyPlaybooks.legacyRunPlaybookInDebug

Full name: projects.locations.instances.legacyPlaybooks.legacyRunPlaybookInDebug

Executes a playbook in a simulation environment using provided test data. Use this method to verify automation logic and identify potential issues before deploying a playbook to production.

HTTP request

POST https://{endpoint}/v1alpha/{instance}/legacyPlaybooks:legacyRunPlaybookInDebug

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The instance to run the playbook in debug for. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "workflow": {
    object (ApiWorkflowDefinitionDataModel)
  },
  "testCaseId": string,
  "triggerEventChanges": {
    object (TriggerEventChanges)
  }
}
Fields
workflow

object (ApiWorkflowDefinitionDataModel)

Required. The workflow to run the playbook in debug for.
testCaseId

string (int64 format)

Required. The test case id to run the playbook in debug for.
triggerEventChanges

object (TriggerEventChanges)

Optional. Changes to the trigger event.

Response body

Response object that holds identifiers of a playbook simulation / debug mode run. Those identifiers are used to fetch results for this specific run

If successful, the response body contains data with the following structure:

JSON representation 
{
  "workflowInstanceId": string,
  "newTestCaseId": string,
  "alertGroupIdentifier": string,
  "alertIdentifier": string,
  "newWorkflowIdentifier": string,
  "parsedNestedInputParameters": {
    string: string,
    ...
  },
  "triggerMatches": boolean
}
Fields
workflowInstanceId

string (int64 format)

Required. Workflow instance id
newTestCaseId

string (int64 format)

Required. The new case id that this playbook will run on
alertGroupIdentifier

string

Required. The group id for the alert
alertIdentifier

string

Required. The alert identifier
newWorkflowIdentifier

string

Required. The new workflow identifier
parsedNestedInputParameters

map (key: string, value: string)

Optional. Dictionary of inner input parameters

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
triggerMatches

boolean

Required. Whether the trigger actually matched when we ran the simulation

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.legacyPlaybooks.update

For more information, see the IAM documentation.

TriggerEventChanges

TriggerEventChanges represents changes in a trigger event for playbook simulation.

JSON representation 
{
  "caseAssignee": {
    object (TriggerEventPropertyValue)
  },
  "alertPriority": {
    object (TriggerEventPropertyValue)
  },
  "casePriority": {
    object (TriggerEventPropertyValue)
  },
  "caseStage": {
    object (TriggerEventPropertyValue)
  },
  "addedCaseTag": string,
  "caseCustomField": {
    object (TriggerFieldChange)
  },
  "caseContextField": {
    object (TriggerFieldChange)
  },
  "alertCustomField": {
    object (TriggerFieldChange)
  },
  "alertContextField": {
    object (TriggerFieldChange)
  },
  "addedEntity": {
    object (TriggerAddedEntity)
  },
  "addedCaseComment": {
    object (AddedCaseComment)
  }
}
Fields
caseAssignee

object (TriggerEventPropertyValue)

Optional. Details about the change in case assignee.
alertPriority

object (TriggerEventPropertyValue)

Optional. Details about the change in alert priority.
casePriority

object (TriggerEventPropertyValue)

Optional. Details about the change in case priority.
caseStage

object (TriggerEventPropertyValue)

Optional. Details about the change in case stage.
addedCaseTag

string

Optional. The tag that was added to the case.
caseCustomField

object (TriggerFieldChange)

Optional. Details about a change in a case custom field.
caseContextField

object (TriggerFieldChange)

Optional. Details about a change in a case context field.
alertCustomField

object (TriggerFieldChange)

Optional. Details about a change in an alert custom field.
alertContextField

object (TriggerFieldChange)

Optional. Details about a change in an alert context field.
addedEntity

object (TriggerAddedEntity)

Optional. The entity that was added to the case.
addedCaseComment

object (AddedCaseComment)

Optional. Details about a comment that was added to the case.

TriggerEventPropertyValue

TriggerEventPropertyValue represents a property value transition.

JSON representation 
{
  "oldValue": string,
  "newValue": string
}
Fields
oldValue

string

Optional. The old value before the change.
newValue

string

Optional. The new value after the change.

TriggerFieldChange

TriggerFieldChange represents a change in a specific field.

JSON representation 
{
  "property": string,
  "propertyValue": {
    object (TriggerEventPropertyValue)
  }
}
Fields
property

string

Required. The name of the property that changed.
propertyValue

object (TriggerEventPropertyValue)

Required. The original and new values of the property.

TriggerAddedEntity

TriggerAddedEntity represents an entity added to the case.

JSON representation 
{
  "identifier": string,
  "type": string
}
Fields
identifier

string

Required. The unique identifier of the added entity.
type

string

Required. The type of the added entity (e.g., Host, User, IP).

AddedCaseComment

AddedCaseComment represents a comment added to a case during simulation.

JSON representation 
{
  "body": string,
  "attachment": string
}
Fields
body

string

Optional. The text content of the comment.
attachment

string

Optional. The name of the attachment associated to comment.