Method: instances.generateRules

Full name: projects.locations.instances.generateRules

Generates a proposed rule given an input Threat Detection Opportunity (TDO).

HTTP request

POST https://{endpoint}/v1alpha/{instance}:generateRules

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The Chronicle instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "threatDetectionOpportunity": {
    object (ThreatDetectionOpportunity)
  }
  // End of mutually exclusive fields.
}
Fields
The originating artifacts that should be used to generate a rule. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
threatDetectionOpportunity

object (ThreatDetectionOpportunity)

The input ThreatDetectionOpportunity to generate a rule from. In the case of the Detection Engineering Agent, this is created by calling the GenerateDetectionOpportunity tool.
End of mutually exclusive fields.

Response body

Response message for instances.generateRules.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "instance": string,
  "generatedRules": [
    {
      object (GeneratedRule)
    }
  ]
}
Fields
instance

string

The Chronicle instance associated with the Threat Detection Opportunity. Format: projects/{project}/locations/{location}/instances/{instance}
generatedRules[]

object (GeneratedRule)

The generated Rules.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle

For more information, see the Authentication Overview.

GeneratedRule

A generated Rule.

JSON representation 
{
  "ruleText": string,
  "feedbackId": string
}
Fields
ruleText

string

The core YARA-L text for the generated Rule.
feedbackId

string

The ID of the feedback report.