Method: instances.evaluateRuleCoverage

Full name: projects.locations.instances.evaluateRuleCoverage

Evaluates whether existing Managed Content rules provide coverage for the input udm.

HTTP request

POST https://{endpoint}/v1alpha/{instance}:evaluateRuleCoverage

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The Chronicle instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "udmsJson": [
    string
  ]
}
Fields
udmsJson[]

string

Required. The input JSON UDM to evaluate all managed content rules against.

Response body

Response message for instances.evaluateRuleCoverage.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "instance": string,
  "coverageResults": [
    {
      object (EvaluatedRuleCoverageResult)
    }
  ]
}
Fields
instance

string

The Chronicle instance associated with the output coverage results. Format: projects/{project}/locations/{location}/instances/{instance}
coverageResults[]

object (EvaluatedRuleCoverageResult)

In the case that there is coverage, return the rule information for the rules found. If there is no known coverage, this list will be empty.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

EvaluatedRuleCoverageResult

Result of evaluating rules against the input UDM.

JSON representation 
{
  "matchedRule": string,
  "feedbackId": string
}
Fields
matchedRule

string

The ID of the rule that provided coverage.
feedbackId

string

The ID of the feedback report.