Method: threatCollections.fetchEntityMetadata

Full name: projects.locations.instances.threatCollections.fetchEntityMetadata

Gets a list of entity metadata for a threat collection.

HTTP request


Path parameters

Parameters
name

string

Required. The resource name of the ThreatCollection to fetch entity metadata for. Format: projects/{project}/locations/{location}/instances/{instance}/threatCollections/{threatCollection}

Query parameters

Parameters
pageSize

integer

Optional. The page size for the number of entities to return. Default and maximum size is 1000.
pageToken

string

Optional. A page token, received from a previous FetchEntityMetadata call. Provide this to retrieve the subsequent page. When paginating, all other parameters provided to FetchEntityMetadata must match the call that provided the page token.

Request body

The request body must be empty.

Response body

Response containing a list of entity metadata.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "entityMetadata": [
    {
      object (ThreatCollectionEntityMetadata)
    }
  ],
  "nextPageToken": string,
  "totalSize": integer
}
Fields
entityMetadata[]

object (ThreatCollectionEntityMetadata)

Output only. A list of entity risks scores with information typing them to the threat collection. Ordered by entity.risk_score.
nextPageToken

string

Output only. A token that can be sent as pageToken to retrieve the next page. If this field is omitted, there are no subsequent pages.
totalSize

integer

Output only. The total number of entities that match the request. The size of the entityMetadata returned by pagination may be less than the totalSize that matches.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

  • chronicle.threatCollections.fetchEntityMetadata

For more information, see the IAM documentation.

ThreatCollectionEntityMetadata

Entity metadata for a threat collection.

JSON representation 
{
  "entity": {
    object (Entity)
  },
  "references": [
    {
      object (ThreatCollectionEntityMetadataReference)
    }
  ]
}
Fields
entity

object (Entity)

An Asset or User entity which contains an entity indicator and riskScore data associated with it.
references[]

object (ThreatCollectionEntityMetadataReference)

A list of references associated with the entity.

ThreatCollectionEntityMetadataReference

A link between a threat collection and an Asset or User entity in a threat collection's entity metadata.

JSON representation 
{

  // Union field reference_type can be only one of the following:
  "ioc": string
  // End of list of possible types for union field reference_type.
}
Fields
Union field reference_type. Possible reference types. reference_type can be only one of the following:
ioc

string

The resource name of the Ioc associated with the entity. Format: projects/{project}/locations/{location}/instances/{instance}/iocs/{ioc}