REST Resource: projects.locations.instances

Resource: Instance

A Instance represents an instantiation of the Instance product.

JSON representation 
{
  "name": string,
  "state": enum (State),
  "purgeTime": string,
  "deleteTime": string,
  "wipeoutStatus": enum (WipeoutState),
  "displayName": string,
  "secopsUrls": [
    string
  ],
  "customerCode": string,
  "createTime": string,
  "complianceRequirements": {
    object (ComplianceRequirements)
  },
  "instanceConfig": {
    object (InstanceConfig)
  },
  "frontendPathConfigs": [
    {
      object (FrontendPathConfig)
    }
  ],
  "entitlement": {
    object (Entitlement)
  }
}
Fields
name

string

Identifier. The resource name of this instance. Format: projects/{project}/locations/{location}/instances/{instance}
state

enum (State)

Output only. The state of the instance.
purgeTime

string (Timestamp format)

Output only. The earliest time that soft-deleted tenants will be permanently deleted and will no longer be able to be undeleted.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
deleteTime

string (Timestamp format)

Output only. The time at which the instance was soft-deleted.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
wipeoutStatus

enum (WipeoutState)

Output only. The wipeout status of the instance.
displayName

string

Output only. The display name of the instance.
secopsUrls[]

string

Output only. URL of the SecOps instance for the instance. https://{frontendPath}.backstory.chronicle.security
customerCode

string

Output only. An acronym related to the company name.
createTime

string (Timestamp format)

Output only. The time at which the instance was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
complianceRequirements

object (ComplianceRequirements)

Optional. Compliance requirements for the instance.
instanceConfig

object (InstanceConfig)

Optional. Instance Configs represents the features that can be enabled/disabled by the customer
frontendPathConfigs[]

object (FrontendPathConfig)

Output only. List of frontend path - workforce pool provider id configs of the instance.
entitlement

object (Entitlement)

Output only. Entitlement information for the Chronicle instance, including details about the customer's package tier, data retention period, billing, and service dates.

WipeoutState

The wipeout status of the instance.

Enums
WIPEOUT_STATE_UNSPECIFIED The default value.
DELETE_REQUESTED The instance has requested deletion.
SOFT_DELETE_IN_PROGRESS The instance is in the process of being soft-deleted.
SOFT_DELETE_COMPLETED The instance has been soft-deleted.
UNDELETE_REQUESTED The instance has requested undeletion.
DATA_DELETION_IN_PROGRESS The instance is in the process of being data deleted.
ERROR The instance has an error during wipeout.
WIPED_OUT The instance has been wiped out.
UNDELETE_COMPLETED The instance has been undeleted.

ComplianceRequirements

Compliance requirements.

JSON representation 
{
  "complianceCertifications": [
    enum (ComplianceCertification)
  ]
}
Fields
complianceCertifications[]

enum (ComplianceCertification)

Optional. A list of compliance certifications.

ComplianceCertification

Compliance certifications.

Enums
COMPLIANCE_CERTIFICATION_UNSPECIFIED LINT.IfChange(instance-compliance-certification) Unspecified compliance certification.
FEDRAMP_MODERATE FedRAMP Moderate.
HIPAA HIPAA.
PCI_DSS PCI DSS.
FEDRAMP_HIGH FedRAMP High.
IL4 IL4.
IL5 IL5.
CHRONICLE_CMEK_V1 Chronicle CMEK V1.
DRZ_ADVANCED DRZ_ADVANCED.
EU_DATA_BOUNDARY EU Data Boundary.
REGIONAL_DATA_BOUNDARY Regional Data Boundary.
AUSTRALIA_DATA_BOUNDARY_AND_SUPPORT Australia Data Boundary and Support.
US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES US Data Boundary for Healthcare and Life Sciences.
US_DATA_BOUNDARY_FOR_HEALTHCARE_AND_LIFE_SCIENCES_WITH_SUPPORT US Data Boundary for Healthcare and Life Sciences with Support.
KSA_DATA_BOUNDARY_WITH_ACCESS_JUSTIFICATIONS KSA Data Boundary with Access Justifications.

InstanceConfig

Instance Configs represents the features that can be enabled/disabled/configured by the customer

JSON representation 
{
  "secopsUiEnabled": boolean,
  "dataRbacEnabled": boolean,
  "triageAgentEnabled": boolean
}
Fields
secopsUiEnabled

boolean

Optional. The desired access state (true for enabled).
dataRbacEnabled

boolean

Optional. The desired access state for Data RBAC (true for enabled).
triageAgentEnabled

boolean

Optional. The desired access state for Triage Agent (true for enabled).

Entitlement

Entitlement for the instance.

JSON representation 
{
  "packageTier": enum (PackageTier),
  "dataRetentionDuration": enum (RetentionDuration),
  "billingAccountId": string,
  "serviceStartTime": string,
  "serviceEndTime": string,
  "dataVolume": string,
  "dreAlignmentStateInfo": {
    object (DREAlignmentStateInfo)
  }
}
Fields
packageTier

enum (PackageTier)

Output only. The customer's package tier.
dataRetentionDuration

enum (RetentionDuration)

Output only. The customer's data retention duration.
billingAccountId

string

Output only. The customer's billing account id.
serviceStartTime

string (Timestamp format)

Output only. The service start time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
serviceEndTime

string (Timestamp format)

Output only. The service end time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
dataVolume

string

Output only. The data volume purchased in GB.
dreAlignmentStateInfo

object (DREAlignmentStateInfo)

Output only. DRE alignment state info.

PackageTier

Package tier for the customer.

Enums
PACKAGE_TIER_UNSPECIFIED Default tier which should never be used.
LEVEL_ONE SIEM standalone.
LEVEL_TWO Enterprise package.
LEVEL_THREE Advanced package.
NEXUS dedicated tier for Nexus
SCCE_LEVEL_ONE SCCE Level One.
SCCE_LEVEL_TWO SCCE Level Two.
SCCE_LEVEL_THREE SCCE Level Three.
SOAR_STANDALONE_STANDARD SOAR standalone standard.
SOAR_STANDALONE_PRO SOAR standalone pro.
GUS Google Unified Security.

DREAlignmentStateInfo

DRE alignment state information.

JSON representation 
{
  "gracePeriodStartTime": string,
  "gracePeriodEndTime": string,
  "state": enum (DREAlignmentState)
}
Fields
gracePeriodStartTime

string (Timestamp format)

Output only. Grace period start time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
gracePeriodEndTime

string (Timestamp format)

Output only. Grace period end time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
state

enum (DREAlignmentState)

Output only. DRE alignment state.

DREAlignmentState

DRE alignment state.

Enums
DRE_ALIGNMENT_STATE_UNSPECIFIED Default value, should not be used.
MISMATCH_FOUND Discrepancy detected between contractual and effective DRE.
GRACE_PERIOD_EXTENDED Grace period for a mismatch has been extended.
ALIGNMENT_COMPLETED Alignment process is complete, effective DRE matches contractual DRE.
EXEMPTED Customer is exempted from DRE alignment.
ALIGNMENT_ERROR An error occurred during the alignment process.

Methods

batchValidateWatchlistEntities

 Validates a batch of entities that could be added into watchlist under an instance.

computeAllFindingsRefinementActivities

 Returns findings refinement activity for all findings refinements.

continuePocGraduation

 ContinuePocGraduation verifies and proceeds graduation.

countAllCuratedRuleSetDetections

 Count detections across all curated rule sets.

createFeedback

 RPC to submit user feedback on content generated by AI services.

delete

 DeleteInstance deletes an Instance.

evaluateRuleCoverage

 Evaluates whether existing Managed Content rules provide coverage for the input udm.

extractSyslog

 ExtractSyslog extracts structured part of log from a unstructured log by running a grok regex over it.

fetchFederationAccess

 FetchFederationAccess method lists all the instances the authenticated user has access to and the operations they can perform over these instances.

findEntity

 Identifies the entity type and retrieves relevant data associated with a specified indicator.

findEntityAlerts

 Get alerts for an entity.

findRelatedEntities

 Finds all the entities associated with provided entity.

findUdmFieldValues

 Finds ingested UDM field values that match a query.

generateCollectionAgentAuth

 GenerateCollectionAgentAuth generates an auth json file for the collection agent.

generateRules

 Generates a proposed rule given an input Threat Detection Opportunity (TDO).

generateSoarAuthJwt

 GenerateSoarAuthJwt signs a jwt in order to proceed with jwt exchange based authenticate with soar.

generateSoarChatMessage

 Generates an AI-driven chat response based on a specific security intent.

generateSyntheticEvents

 Generates synthetic events (both raw logs and UDM) for an input Threat Detection Opportunity (TDO).

generateThreatDetectionOpportunity

 GenerateThreatDetectionOpportunity generates a Threat Detection Opportunity (TDO).

generateUdmKeyValueMappings

 GenerateUDMKeyValueMappings generates key value mapping of a raw log.

generateWorkspaceConnectionToken

 Generates a token that can be used to connect a workspace customer to a chronicle instance

get

 Gets a Instance.

getAgentSettings

 GetAgentSettings gets the agent settings for an instance.

getBigQueryExport

 Get the BigQuery export configuration for a Chronicle instance.

getEnrichmentCombination

 Get the EnrichmentCombination.

getManagedDomainSettings

 Gets the ManagedDomainSettings singleton for a customer.

getMultitenantDirectory

 Gets the super and subtenants and gets the current tenant name.

getRiskConfig

 Queries the instance to get the Risk Configurations used for the computation of Entity Risk Score.

getThreatCollectionFilterSet

 Get the set of threat collection filter options.

graduatePocInstance

 GraduatePocInstance graduates an instance.

legacyCaseFederationPlatforms

 Lists all LegacyCaseFederationPlatforms configured in the primary instance.

legacySystemMetadata

 Returns essential system metadata for the requesting user.

listAllFindingsRefinementDeployments

 Lists all findings refinement deployments.

patch

 Updates an Instance.

queryProductSourceStats

 Gets available product sources along with their stats.

runThreatHunt

 Runs a Threat Hunt.
Initiates a long-running search operation.

searchEntities

 Identifies the entity type and retrieves relevant data associated with a specified indicator.

searchRawLogs

 Api to get events, entities, or unparsed raw logs matching the given raw log query.

submitResponseFeedback

 Submits user feedback for a specific platform interaction or feature.

suggestSql

 SuggestSql suggests auto completion text for a GoogleSQL query.

summarizeEntitiesFromQuery

 Parses the query and identifies the entities contained within the search query.

summarizeEntity

 Returns all entity data over specified time.

testFindingsRefinement

 Tests for and returns past activity for a findings refinement, including, potentially, times when the findings refinement was not yet created.

translateUdmQuery

 Translate natural language to a UDM Search query.

translateYlRule

 Translate natural language to a Yara-L rule.

udmSearch

 Performs a UDM search that returns matching events for the query.

undelete

 UndeleteInstance undeletes a soft-deleted Instance.

updateAgentSettings

 UpdateAgentSettings updates the agent settings for an instance.

updateBigQueryExport

 Update the BigQuery export configuration for a Chronicle instance.

updateRiskConfig

 Updates RiskConfig used for the computation of Entity Risk Score.

validateQuery

 Validates UDM search query by compiling the query.

verifyNonce

 Verifies the nonce used to graduate an instance.

verifyReferenceList

 VerifyReferenceList validates list content and returns line errors, if any.

verifyRuleText

 Verifies the given rule text.