Full name: projects.locations.instances.iocs.find
Gets a list of Iocs given a list of parameters that uniquely identify them.
HTTP request
POST https://{endpoint}/v1beta/{parent}/iocs:find
Where {endpoint}
is one of the supported service endpoints
.
Path parameters
| Parameters | |
|---|---|
parent
|
Required. The parent, which is the SecOps instance. Format: projects/{project}/locations/{location}/instances/{instance} |
Request body
The request body contains data with the following structure:
| JSON representation |
|---|
{
"fieldAndValue"
:
[
{
object (
|
| Fields | |
|---|---|
fieldAndValue[]
|
Required. Parameters to identify the IOCs. Each item should uniquely identify one Ioc record. Only |
Response body
The response to a iocs.find request.
If successful, the response body contains data with the following structure:
| JSON representation |
|---|
{
"iocs"
:
[
{
object (
|
| Fields | |
|---|---|
iocs[]
|
The Iocs that match the request. Note this returns a max of 1000 IOCs, in the order requested. |
Authorization scopes
Requires one of the following OAuth scopes:
-
https://www.googleapis.com/auth/cloud-platform -
https://www.googleapis.com/auth/chronicle -
https://www.googleapis.com/auth/chronicle.readonly
For more information, see the Authentication Overview .
IAM Permissions
Requires the following IAM
permission on the parent
resource:
-
chronicle.iocs.findIocs
For more information, see the IAM documentation .
