Method: mappingRules.save

Full name: projects.locations.instances.ontologyRecords.mappingRules.save

Save a mapping rule.

HTTP request


Path parameters

Parameters
parent

string

Required. The parent resource name. Format: projects/{project}/locations/{location}/instances/{instance}/ontologyRecords/{ontologyRecord}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "securityEventFieldName": string,
  "transformationFunction": enum (TransformationFunction),
  "rawDataPrimaryFieldMatchTerm": string,
  "rawDataPrimaryFieldComparisonType": enum (ComparisonType),
  "enrichmentFields": [
    string
  ],
  "isArtifact": boolean,
  "extractionFunction": enum (ExtractionFunction),
  "mappingRuleId": integer,
  "ontologyConfigurationLevel": enum (OntologyConfigurationLevel),
  "targetFieldType": enum (TargetFieldType),
  "transformationFunctionParam": string,
  "rawDataSecondaryFieldMatchTerm": string,
  "rawDataSecondaryFieldComparisonType": enum (ComparisonType),
  "rawDataThirdFieldMatchTerm": string,
  "rawDataThirdFieldComparisonType": enum (ComparisonType),
  "extractionFunctionParam": string
}
Fields
securityEventFieldName

string

Required. The name of the security event field.
transformationFunction

enum (TransformationFunction)

Required. The transformation function to apply.
rawDataPrimaryFieldMatchTerm

string

Required. The primary field match term in the raw data.
rawDataPrimaryFieldComparisonType

enum (ComparisonType)

Required. The comparison type for the primary field.
enrichmentFields[]

string

Optional. Enrichment fields (if any).
isArtifact

boolean

Required. Indicates if this rule is for artifact extraction.
extractionFunction

enum (ExtractionFunction)

Required. The extraction function to apply.
mappingRuleId

integer

Required. Unique numeric ID for the MappingRule.
ontologyConfigurationLevel

enum (OntologyConfigurationLevel)

Required. Ontology Configuration Level.
targetFieldType

enum (TargetFieldType)

Required. Target Field Type.
transformationFunctionParam

string

Optional. Parameters for the transformation function (if any).
rawDataSecondaryFieldMatchTerm

string

Optional. The secondary field match term in the raw data (optional).
rawDataSecondaryFieldComparisonType

enum (ComparisonType)

Optional. The comparison type for the secondary field.
rawDataThirdFieldMatchTerm

string

Optional. The third field match term in the raw data (optional).
rawDataThirdFieldComparisonType

enum (ComparisonType)

Optional. The comparison type for the third field.
extractionFunctionParam

string

Optional. Extraction function parameters (if any).

Response body

If successful, the response body is an empty JSON object.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.mappingRules.update

For more information, see the IAM documentation.