Console
    Start free

    LegacyCaseInfo

    CaseInfo represents the case information model.

    JSON representation 
     { 
 "creatorUserId" 
 : 
 string 
 , 
 "events" 
 : 
 [ 
 { 
 object (  LegacyCaseSecurityEvent 
 
) 
 } 
 ] 
 , 
 "environment" 
 : 
 string 
 , 
 "sourceSystemName" 
 : 
 string 
 , 
 "ticketId" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "displayId" 
 : 
 string 
 , 
 "reason" 
 : 
 string 
 , 
 "name" 
 : 
 string 
 , 
 "deviceVendor" 
 : 
 string 
 , 
 "deviceProduct" 
 : 
 string 
 , 
 "startTime" 
 : 
 string 
 , 
 "endTime" 
 : 
 string 
 , 
 "ruleGenerator" 
 : 
 string 
 , 
 "sourceGroupingIdentifier" 
 : 
 string 
 , 
 "playbookTriggerKeywords" 
 : 
 [ 
 string 
 ] 
 , 
 "extensions" 
 : 
 [ 
 { 
 object (  LegacyCasePropertyValue 
 
) 
 } 
 ] 
 , 
 "attachments" 
 : 
 [ 
 { 
 object (  LegacyCaseInfoAttachment 
 
) 
 } 
 ] 
 , 
 "sourceSystemUrl" 
 : 
 string 
 , 
 "sourceRuleIdentifier" 
 : 
 string 
 , 
 "siemAlertId" 
 : 
 string 
 , 
 "updatedFields" 
 : 
 [ 
 { 
 object (  LegacyCasePropertyValue 
 
) 
 } 
 ] 
 , 
 "alertMetadata" 
 : 
 { 
 string 
 : 
 value 
 , 
 ... 
 } 
 , 
 "dataAccessScope" 
 : 
 string 
 , 
 "type" 
 : 
 enum (  CaseType 
 
) 
 , 
 "priority" 
 : 
 enum (  CasePriority 
 
) 
 , 
 "isTrimmed" 
 : 
 boolean 
 , 
 "dataType" 
 : 
 enum (  LoadDataTypeEnumQueue 
 
) 
 , 
 "sourceType" 
 : 
 enum (  IngestionSourceType 
 
) 
 , 
 "alertUpdateSupported" 
 : 
 boolean 
 }
    Fields
    creatorUserId

    string

    Optional. CreatorUserId identifies the user who creates this case - only relevant for cases of type Request.
    events[]

    object ( LegacyCaseSecurityEvent )

    Required. Events is a list of the events that make up this case.
    environment

    string

    Optional. Environment is the case environment.
    sourceSystemName

    string

    Optional. SourceSystemName is the name of the source system - based on the connector.
    ticketId

    string

    Optional. TicketId is the external case id received from the external product - based on the connector.
    description

    string

    Optional. Description is the case description.
    displayId

    string

    Optional. DisplayId is the external case display id received from the external product - based on the connector.
    reason

    string

    Optional. Reason is the case reason.
    name

    string

    Optional. Name is the case name.
    deviceVendor

    string

    Optional. DeviceVendor is the case product vendor - based on the connector.
    deviceProduct

    string

    Optional. DeviceProduct is the case product vendor - based on the connector.
    startTime

    string ( int64 format)

    Optional. StartTime is the case starting time in unix format as milliseconds - based on the connector. Represents DateTime StartTime as unix time
    endTime

    string ( int64 format)

    Optional. EndTime is the case ending time in unix format as milliseconds - based on the connector. Represents DateTime EndTime as unix time
    ruleGenerator

    string

    Optional. RuleGenerator is the rule that generates this case - based on the connector.
    sourceGroupingIdentifier

    string

    Optional. SourceGroupingIdentifier is the source grouping identifier will be used to group alert into one case - depends on alert grouping configuration - based on the connector.
    playbookTriggerKeywords[]

    string

    Optional. PlaybookTriggerKeywords is the playbook trigger keywords - used for 'Alert Trigger Value' playbook trigger type.
    extensions[]

    object ( LegacyCasePropertyValue )

    Optional. Extensions is an obsolete field.
    attachments[]

    object ( LegacyCaseInfoAttachment )

    Optional. Attachments is the case attachments - based on the connector.
    sourceSystemUrl

    string

    Optional. SourceSystemUrl is the configured source url - defined in the connector that ingested this alert.
    sourceRuleIdentifier

    string

    Optional. SourceRuleIdentifier is the configured source rule url - defined in the connector that ingested this alert.
    siemAlertId

    string

    Optional. SiemAlertId is the Chronicle SIEM alert identifier.
    updatedFields[]

    object ( LegacyCasePropertyValue )

    Optional. UpdatedFields is the alert Updated Fields.
    alertMetadata

    map (key: string, value: value ( Value format))

    Optional. AlertMetadata is the additional alert metadata as key-value pairs.

    An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" } .
    dataAccessScope

    string

    Optional. DataAccessScope is the Chronicle SIEM resource name of the DataAccessScope of this alert.
    type

    enum ( CaseType )

    Optional. Type is the case type.
    priority

    enum ( CasePriority )

    Optional. Priority is the case priority.
    isTrimmed

    boolean

    Optional. IsTrimmed is a flag that indicates whether the case got trimmed or not.
    dataType

    enum ( LoadDataTypeEnumQueue )

    Optional. DataType is the case data type.
    sourceType

    enum ( IngestionSourceType )

    Optional. SourceType is the case source type.
    alertUpdateSupported

    boolean

    Optional. AlertUpdateSupported indicates if the alert source system support alert updates.

    LegacyCaseSecurityEvent

    SecurityEvent represents a security event.

    JSON representation 
     { 
 "environment" 
 : 
 string 
 , 
 "sourceSystemName" 
 : 
 string 
 , 
 "extensions" 
 : 
 [ 
 { 
 object (  LegacyCasePropertyValue 
 
) 
 } 
 ] 
 , 
 "parentEventId" 
 : 
 string 
 , 
 "sourceMacAddress" 
 : 
 string 
 , 
 "destinationMacAddress" 
 : 
 string 
 , 
 "name" 
 : 
 string 
 , 
 "message" 
 : 
 string 
 , 
 "type" 
 : 
 string 
 , 
 "severity" 
 : 
 string 
 , 
 "eventId" 
 : 
 string 
 , 
 "managerReceiptTime" 
 : 
 string 
 , 
 "startTime" 
 : 
 string 
 , 
 "ruleGenerator" 
 : 
 string 
 , 
 "endTime" 
 : 
 string 
 , 
 "deviceHostName" 
 : 
 string 
 , 
 "deviceAddress" 
 : 
 string 
 , 
 "destinationDnsDomain" 
 : 
 string 
 , 
 "destinationNtDomain" 
 : 
 string 
 , 
 "sourceDnsDomain" 
 : 
 string 
 , 
 "sourceNtDomain" 
 : 
 string 
 , 
 "deviceEventClassId" 
 : 
 string 
 , 
 "transportProtocol" 
 : 
 string 
 , 
 "applicationProtocol" 
 : 
 string 
 , 
 "destinationPort" 
 : 
 string 
 , 
 "categoryOutcome" 
 : 
 string 
 , 
 "deviceEventCategory" 
 : 
 string 
 , 
 "deviceVendor" 
 : 
 string 
 , 
 "deviceProduct" 
 : 
 string 
 , 
 "deviceSeverity" 
 : 
 string 
 , 
 "fileType" 
 : 
 string 
 , 
 "baseEventIds" 
 : 
 [ 
 string 
 ] 
 , 
 "cefVersion" 
 : 
 string 
 , 
 "deviceVersion" 
 : 
 string 
 , 
 "signatureId" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "receiptTime" 
 : 
 string 
 , 
 "rawDataFields" 
 : 
 { 
 string 
 : 
 string 
 , 
 ... 
 } 
 , 
 "destinationUrl" 
 : 
 string 
 , 
 "creditCard" 
 : 
 string 
 , 
 "phoneNumber" 
 : 
 string 
 , 
 "cve" 
 : 
 string 
 , 
 "threatActor" 
 : 
 string 
 , 
 "threatCampaign" 
 : 
 string 
 , 
 "process" 
 : 
 string 
 , 
 "parentProcess" 
 : 
 string 
 , 
 "parentHash" 
 : 
 string 
 , 
 "childProcess" 
 : 
 string 
 , 
 "ipset" 
 : 
 string 
 , 
 "cluster" 
 : 
 string 
 , 
 "application" 
 : 
 string 
 , 
 "database" 
 : 
 string 
 , 
 "pod" 
 : 
 string 
 , 
 "container" 
 : 
 string 
 , 
 "service" 
 : 
 string 
 , 
 "genericEntity" 
 : 
 string 
 , 
 "sourceProcessName" 
 : 
 string 
 , 
 "fileName" 
 : 
 string 
 , 
 "fileHash" 
 : 
 string 
 , 
 "deployment" 
 : 
 string 
 , 
 "emailSubject" 
 : 
 string 
 , 
 "threatSignature" 
 : 
 string 
 , 
 "usb" 
 : 
 string 
 , 
 "childHash" 
 : 
 string 
 , 
 "sourceHostName" 
 : 
 string 
 , 
 "sourceAddress" 
 : 
 string 
 , 
 "destinationHostName" 
 : 
 string 
 , 
 "destinationAddress" 
 : 
 string 
 , 
 "destinationUserName" 
 : 
 string 
 , 
 "sourceUserName" 
 : 
 string 
 , 
 "sourceUserId" 
 : 
 string 
 , 
 "destinationProcessName" 
 : 
 string 
 , 
 "sourceDomain" 
 : 
 string 
 , 
 "destinationDomain" 
 : 
 string 
 , 
 "fields" 
 : 
 { 
 string 
 : 
 value 
 , 
 ... 
 } 
 , 
 "isCorrelation" 
 : 
 boolean 
 }
    Fields
    environment

    string

    Required. Environment is the event environment.
    sourceSystemName

    string

    Optional. SourceSystemName is the name of the source system.
    extensions[]

    object ( LegacyCasePropertyValue )

    Optional. Extensions is a list of key-value pairs for event extensions.
    parentEventId

    string ( int64 format)

    Optional. ParentEventId is the ID of the parent event.
    sourceMacAddress

    string

    Optional. SourceMacAddress is the source MAC address.
    destinationMacAddress

    string

    Optional. DestinationMacAddress is the destination MAC address.
    name

    string

    Optional. Name is the name of the event.
    message

    string

    Optional. Message is the event message.
    type

    string

    Optional. Type is the event type.
    severity

    string

    Optional. Severity is the event severity.
    eventId

    string

    Optional. EventId is the event identifier.
    managerReceiptTime

    string

    Optional. ManagerReceiptTime is the manager receipt time.
    startTime

    string

    Optional. StartTime is the event start time.
    ruleGenerator

    string

    Optional. RuleGenerator is the rule that generated the event.
    endTime

    string

    Optional. EndTime is the event end time.
    deviceHostName

    string

    Optional. DeviceHostName is the device host name.
    deviceAddress

    string

    Optional. DeviceAddress is the device address.
    destinationDnsDomain

    string

    Optional. DestinationDnsDomain is the destination DNS domain.
    destinationNtDomain

    string

    Optional. DestinationNtDomain is the destination NT domain.
    sourceDnsDomain

    string

    Optional. SourceDnsDomain is the source DNS domain.
    sourceNtDomain

    string

    Optional. SourceNtDomain is the source NT domain.
    deviceEventClassId

    string

    Optional. DeviceEventClassId is the device event class ID.
    transportProtocol

    string

    Optional. TransportProtocol is the transport protocol.
    applicationProtocol

    string

    Optional. ApplicationProtocol is the application protocol.
    destinationPort

    string

    Optional. DestinationPort is the destination port.
    categoryOutcome

    string

    Optional. CategoryOutcome is the category outcome.
    deviceEventCategory

    string

    Optional. DeviceEventCategory is the device event category.
    deviceVendor

    string

    Optional. DeviceVendor is the device vendor.
    deviceProduct

    string

    Optional. DeviceProduct is the device product.
    deviceSeverity

    string

    Optional. DeviceSeverity is the device severity.
    fileType

    string

    Optional. FileType is the file type.
    baseEventIds[]

    string ( int64 format)

    Optional. BaseEventIds is a list of base event IDs.
    cefVersion

    string

    Optional. CefVersion is the CEF version.
    deviceVersion

    string

    Optional. DeviceVersion is the device version.
    signatureId

    string

    Optional. SignatureId is the signature ID.
    description

    string

    Optional. Description is the event description.
    receiptTime

    string

    Optional. ReceiptTime is the receipt time.
    rawDataFields

    map (key: string, value: string)

    Optional. RawDataFields is a map of raw data fields.

    An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" } .
    destinationUrl

    string

    Optional. DestinationURL is the destination URL.
    creditCard

    string

    Optional. CreditCard is the credit card information.
    phoneNumber

    string

    Optional. PhoneNumber is the phone number.
    cve

    string

    Optional. CVE is the CVE identifier.
    threatActor

    string

    Optional. ThreatActor is the threat actor.
    threatCampaign

    string

    Optional. ThreatCampaign is the threat campaign.
    process

    string

    Optional. Process is the process name.
    parentProcess

    string

    Optional. ParentProcess is the parent process name.
    parentHash

    string

    Optional. ParentHash is the parent hash.
    childProcess

    string

    Optional. ChildProcess is the child process name.
    ipset

    string

    Optional. IPSET is the IP set.
    cluster

    string

    Optional. Cluster is the cluster name.
    application

    string

    Optional. Application is the application name.
    database

    string

    Optional. Database is the database name.
    pod

    string

    Optional. Pod is the pod name.
    container

    string

    Optional. Container is the container name.
    service

    string

    Optional. Service is the service name.
    genericEntity

    string

    Optional. GenericEntity is a generic entity.
    sourceProcessName

    string

    Optional. SourceProcessName is the source process name.
    fileName

    string

    Optional. FileName is the file name.
    fileHash

    string

    Optional. FileHash is the file hash.
    deployment

    string

    Optional. Deployment is the deployment name.
    emailSubject

    string

    Optional. EmailSubject is the email subject.
    threatSignature

    string

    Optional. ThreatSignature is the threat signature.
    usb

    string

    Optional. USB is the USB information.
    childHash

    string

    Optional. ChildHash is the child hash.
    sourceHostName

    string

    Optional. SourceHostName is the source host name.
    sourceAddress

    string

    Optional. SourceAddress is the source address.
    destinationHostName

    string

    Optional. DestinationHostName is the destination host name.
    destinationAddress

    string

    Optional. DestinationAddress is the destination address.
    destinationUserName

    string

    Optional. DestinationUserName is the destination user name.
    sourceUserName

    string

    Optional. SourceUserName is the source user name.
    sourceUserId

    string

    Optional. SourceUserID is the source user ID.
    destinationProcessName

    string

    Optional. DestinationProcessName is the destination process name.
    sourceDomain

    string

    Optional. SourceDomain is the source domain.
    destinationDomain

    string

    Optional. DestinationDomain is the destination domain.
    fields

    map (key: string, value: value ( Value format))

    Optional. Fields is a map of fields.

    An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" } .
    isCorrelation

    boolean

    Optional. IsCorrelation indicates if the event is a correlation.

    LegacyCasePropertyValue

    PropertyValue represents a key-value pair.

    JSON representation 
     { 
 "key" 
 : 
 string 
 , 
 "value" 
 : 
 string 
 }
    Fields
    key

    string

    Required. Key is the property key.
    value

    string

    Required. Value is the property value.

    CaseType

    LINT.IfChange(CaseType) CaseType represents the type of a case.

    Enums
    EXTERNAL External case type.
    TEST Test case type.
    REQUEST Request case type.

    CasePriority

    CasePriority represents the priority of a case. LINT.IfChange(CasePriority)

    Enums
    UNCHANGED Unchanged case priority.
    LOW Low case priority.
    MEDIUM Medium case priority.
    HIGH High case priority.
    CRITICAL Critical case priority.
    INFORMATIVE Informative case priority.

    LegacyCaseInfoAttachment

    CaseInfoAttachment represents the case attachment model.

    JSON representation 
     { 
 "base64Blob" 
 : 
 string 
 , 
 "type" 
 : 
 string 
 , 
 "name" 
 : 
 string 
 , 
 "description" 
 : 
 string 
 , 
 "isImportant" 
 : 
 boolean 
 }
    Fields
    base64Blob

    string

    Required. Base64Blob is the base64 representation of the attachment.
    type

    string

    Optional. Type is the type of the attachment.
    name

    string

    Optional. Name is the name of the attachment.
    description

    string

    Optional. Description is the description of the attachment.
    isImportant

    boolean

    Optional. IsImportant indicates if the attachment is important.

    LoadDataTypeEnumQueue

    LoadDataTypeEnumQueue represents the type of data to load.

    Enums
    EVENTS Events data type.
    CASES Cases data type.
    CONNECTOR_LOG Connector log data type.
    CONNECTOR_OVERFLOW Connector overflow data type.

    IngestionSourceType

    IngestionSourceType represents the source type of an ingestion.

    Enums
    CONNECTOR Connector ingestion source type.
    WEBHOOK Webhook ingestion source type.
    Design a Mobile Site
    View Site in Mobile | Classic
    Share by: