Method: involvedEntities.fetchCards

• HTTP request
• Path parameters
• Request body
• Response body
  • JSON representation
• Authorization scopes
• IAM Permissions
• InvolvedEntityCard
  • JSON representation
• SecurityEntityDirection

Full name: projects.locations.instances.cases.caseAlerts.involvedEntities.fetchCards

Returns metadate of each involved entity in a specific alert, including their connectivity and high-level status. Use this method to populate visual graphs or high-level summaries of an investigation scope.

HTTP request

Choose a location:

africa-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-central2 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu

GET https://chronicle.africa-south1.rep.googleapis.com/v1beta/{parent}/involvedEntities:fetchCards

Path parameters

Parameters
parent	string Required. Format: projects/{project}/locations/{location}/instances/{instance}/cases/{case}/caseAlerts/{caseAlert}/involvedEntities:fetchCards

Request body

The request body must be empty.

Response body

Response message for FetchCards.

If successful, the response body contains data with the following structure:

JSON representation
{ "cards": [ { object (InvolvedEntityCard) } ] }

Fields
cards[]	object (InvolvedEntityCard) Required. The list of cards.

Authorization scopes

Requires one of the following OAuth scopes:

• https://www.googleapis.com/auth/cloud-platform
• https://www.googleapis.com/auth/chronicle
• https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

• chronicle.involvedEntities.get

For more information, see the IAM documentation.

InvolvedEntityCard

Involved entity card.

JSON representation
{ "identifier": string, "type": string, "linkedEntities": [ { object (InvolvedEntityCard) } ], "suspicious": boolean, "direction": enum (SecurityEntityDirection) }

Fields
identifier	string Required. The identifier of the entity.
type	string Required. The type of the entity.
linkedEntities[]	object (InvolvedEntityCard) Required. Involved entity card.
suspicious	boolean Required. Is the entity suspicious.
direction	enum (SecurityEntityDirection) Required. Security entity direction.

SecurityEntityDirection

Security entity direction.

Enums
NONE	Unspecified security entity direction.
INBOUND	Inbound security entity direction.
OUTBOUND	Outbound security entity direction.
BOTH	Both inbound and outbound security entity direction.