Method: instances.createFeedback

Full name: projects.locations.instances.createFeedback

RPC to submit user feedback on content generated by AI services.

HTTP request

POST https://{endpoint}/v1alpha/{instance}:createFeedback

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The Chronicle instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "type": enum (FeedbackType),
  "comment": string,

  // Union field metadata can be only one of the following:
  "udmQueryFeedback": {
    object (UdmQueryFeedback)
  },
  "ylRuleFeedback": {
    object (YLRuleFeedback)
  },
  "investigationFeedback": {
    object (InvestigationFeedback)
  },
  "agentFeedback": {
    object (AgentFeedback)
  }
  // End of list of possible types for union field metadata.
}
Fields
type

enum (FeedbackType)

Optional. Feedback type.
comment

string

Optional. Feedback comment.
Union field metadata. The feedback metadata associated with the user feedback. metadata can be only one of the following:
udmQueryFeedback

object (UdmQueryFeedback)

Feedback metadata for UDM query translation.
ylRuleFeedback

object (YLRuleFeedback)

Feedback metadata for Yara-L rule translation.
investigationFeedback

object (InvestigationFeedback)

Feedback metadata for Investigation and its components.
agentFeedback

object (AgentFeedback)

Feedback metadata for an AI Agent's output.

Response body

Response message for instances.createFeedback.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "feedbackId": string
}
Fields
feedbackId

string

Unique ID for this translation. Currently only used for audit logging purpose only.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.ais.createFeedback

For more information, see the IAM documentation.

UdmQueryFeedback

UdmQueryFeedback contains metadata for the feedback submitted on UDM query translation.

JSON representation 
{
  "originalInputText": string,
  "originalOutputQuery": string,
  "rewrittenQuery": string
}
Fields
originalInputText

string

Required. The original natural language text used for the translation.
originalOutputQuery

string

Optional. Original UDM query returned by the translation.
rewrittenQuery

string

Optional. Rewritten UDM query (if modified).

YLRuleFeedback

YLRuleFeedback contains metadata for the feedback submitted on Yara-L rule translation.

JSON representation 
{
  "originalInputDescription": string,
  "originalInputQuery": string,
  "originalOutputRule": string,
  "rewrittenRule": string
}
Fields
originalInputDescription

string

Required. The original natural language description used for the translation.
originalInputQuery

string

Optional. The original UDM query used for the rule generation.
originalOutputRule

string

Optional. Original Yara-L rule returned by the translation.
rewrittenRule

string

Optional. Rewritten Yara-L rule text (if modified).

InvestigationFeedback

InvestigationFeedback contains metadata for the feedback submitted on Investigation and its components.

JSON representation 
{
  "feedbackTarget": enum (FeedbackTarget),
  "feedbackRating": enum (FeedbackRating),
  "feedbackLabels": [
    string
  ],

  // Union field target can be only one of the following:
  "investigation": string,
  "investigationStep": string
  // End of list of possible types for union field target.
}
Fields
feedbackTarget

enum (FeedbackTarget)

Required. Specifies which part of Investigation being reviewed
feedbackRating

enum (FeedbackRating)

Optional. Represents the satisfaction rating
feedbackLabels[]

string

Optional. The labels for the feedback. eg. Incorrect Info, Info etc.
Union field target. Target for which the feedback is submitted. target can be only one of the following:
investigation

string

Reference to the investigation.
investigationStep

string

Reference to the investigation step.

FeedbackTarget

FeedbackTarget contains the target of the feedback.

Enums
FEEDBACK_TARGET_UNSPECIFIED The target of the feedback is unknown.
SUMMARY_VERDICT

The target of the feedback is summary verdict.
SUGGESTED_NEXT_STEPS The target of the feedback is suggested next steps.
INVESTIGATION_STEP The target of the feedback is investigation step.
VERDICT The target of the feedback is Verdict
SUMMARY The target of the feedback is Summary.

FeedbackRating

FeedbackRating contains the rating of the feedback.

Enums
FEEDBACK_RATING_UNSPECIFIED The rating of the feedback is unknown.
VERY_SATISFIED The rating of the feedback is very satisfied.
SOMEWHAT_SATISFIED The rating of the feedback is somewhat satisfied.
NEUTRAL The rating of the feedback is neutral.
SOMEWHAT_DISSATISFIED The rating of the feedback is somewhat dissatisfied.
VERY_DISSATISFIED The rating of the feedback is very dissatisfied.

AgentFeedback

Represents a generic container for feedback on AI agent outputs.

JSON representation 
{
  "resourceContext": {
    object (ResourceContext)
  },
  "agent": enum (AgentName),
  "feedback": [
    {
      object (ItemFeedback)
    }
  ]
}
Fields
resourceContext

object (ResourceContext)

Required. Context of the resource the agent was run against.
agent

enum (AgentName)

Required. Name of agent.
feedback[]

object (ItemFeedback)

Required. Detailed feedback on a specific part of the agent's output. This top-level ItemFeedback can represent the overall feedback or the root of a more complex feedback structure.

ResourceContext

Contains context about the primary resource this feedback relates to.

JSON representation 
{
  "primaryResource": string
}
Fields
primaryResource

string

Required. Example: For THA, this would be the Case resource name. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}

AgentName

Represents the different types of agents.

Enums
AGENT_NAME_UNKNOWN The agent is unknown.
THREAT_HUNT_AGENT The agent is a threat hunt agent.
TRIAGE_AGENT The agent is a triage agent.
CHAT_AGENT The agent is a chat agent.

ItemFeedback

Provides feedback on a specific item or component. Items can be nested.

JSON representation 
{
  "itemId": string,
  "itemType": string,
  "content": {
    object (FeedbackContent)
  },
  "subItems": [
    {
      object (ItemFeedback)
    }
  ]
}
Fields
itemId

string

Required. The key or identifier for the item.
itemType

string

Required. Type of the item (e.g., "hunt-summary", "hunt-determination", "step-task", "step-query", "step-summary").
content

object (FeedbackContent)

Optional. The actual feedback content for this specific item.
subItems[]

object (ItemFeedback)

Optional. Optional: Nested feedback for sub-items or sub-components.

FeedbackContent

Contains the actual feedback ratings.

JSON representation 
{
  "rating": enum (FeedbackRating),
  "reasonLabels": [
    string
  ]
}
Fields
rating

enum (FeedbackRating)

Optional. Represents the satisfaction rating for the item.
reasonLabels[]

string

Optional. The optional reasons for the given rating (multi-select).

FeedbackType

Feedback types.

Enums
FEEDBACK_TYPE_UNKNOWN Unknown feedback.
POSITIVE Positive feedback.
NEGATIVE Negative feedback.
REWRITE Negative feedback with a rewritten answer.
DISCARD Indicates a generated response was discarded.