chronicle
library
Classes
BigQueryExport
BigQueryExport resource represents the BigQuery export configuration for a Chronicle instance.
BigQueryExportArgs
The set of arguments for BigQueryExport.
The set of arguments for BigQueryExport.
BigQueryExportEntityGraphSettings
BigQueryExportIocMatchesSettings
BigQueryExportRuleDetectionsSettings
BigQueryExportState
Input properties used for looking up and filtering BigQueryExport resources.
BigQueryExportUdmEventsAggregatesSettings
BigQueryExportUdmEventsSettings
CustomList
The custom list is a list of objects, that can be saved as a shared resource, and can be used by playbooks.
CustomListArgs
The set of arguments for CustomList.
The set of arguments for CustomList.
CustomListState
Input properties used for looking up and filtering CustomList resources.
DashboardChart
A chart resource used within a NativeDashboard. Its lifecycle (Create, Update, Delete) is managed via custom methods on the NativeDashboard resource.
DashboardChartArgs
The set of arguments for DashboardChart.
The set of arguments for DashboardChart.
DashboardChartChartLayout
DashboardChartDashboardChart
DashboardChartDashboardChartChartDatasource
DashboardChartDashboardChartDrillDownConfig
DashboardChartDashboardChartDrillDownConfigLeftDrillDown
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettings
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettingsExternalLink
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettingsFilter
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettingsFilterDashboardFilter
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettingsFilterDashboardFilterFilterOperatorAndValue
DashboardChartDashboardChartDrillDownConfigLeftDrillDownCustomSettingsQuery
DashboardChartDashboardChartDrillDownConfigLeftDrillDownDefaultSettings
DashboardChartDashboardChartDrillDownConfigRightDrillDown
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettings
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettingsExternalLink
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettingsFilter
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettingsFilterDashboardFilter
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettingsFilterDashboardFilterFilterOperatorAndValue
DashboardChartDashboardChartDrillDownConfigRightDrillDownCustomSettingsQuery
DashboardChartDashboardChartDrillDownConfigRightDrillDownDefaultSettings
DashboardChartDashboardChartVisualization
DashboardChartDashboardChartVisualizationButton
DashboardChartDashboardChartVisualizationButtonProperties
DashboardChartDashboardChartVisualizationColumnDef
DashboardChartDashboardChartVisualizationGoogleMapsConfig
DashboardChartDashboardChartVisualizationGoogleMapsConfigDataSettings
DashboardChartDashboardChartVisualizationGoogleMapsConfigMapPosition
DashboardChartDashboardChartVisualizationGoogleMapsConfigPointSettings
DashboardChartDashboardChartVisualizationLegend
DashboardChartDashboardChartVisualizationMarkdown
DashboardChartDashboardChartVisualizationMarkdownProperties
DashboardChartDashboardChartVisualizationSeries
DashboardChartDashboardChartVisualizationSeriesAreaStyle
DashboardChartDashboardChartVisualizationSeriesDataLabel
DashboardChartDashboardChartVisualizationSeriesEncode
DashboardChartDashboardChartVisualizationSeriesGaugeConfig
DashboardChartDashboardChartVisualizationSeriesGaugeConfigBaseValue
DashboardChartDashboardChartVisualizationSeriesGaugeConfigLimitValue
DashboardChartDashboardChartVisualizationSeriesGaugeConfigThresholdValue
DashboardChartDashboardChartVisualizationSeriesItemColors
DashboardChartDashboardChartVisualizationSeriesItemColorsColor
DashboardChartDashboardChartVisualizationSeriesItemColorsColorValue
DashboardChartDashboardChartVisualizationSeriesItemStyle
DashboardChartDashboardChartVisualizationSeriesMetricTrendConfig
DashboardChartDashboardChartVisualizationTableConfig
DashboardChartDashboardChartVisualizationTableConfigColumnRenderTypeSetting
DashboardChartDashboardChartVisualizationTableConfigColumnTooltipSetting
DashboardChartDashboardChartVisualizationTooltip
DashboardChartDashboardChartVisualizationVisualMap
DashboardChartDashboardChartVisualizationVisualMapPiece
DashboardChartDashboardChartVisualizationXAxis
DashboardChartDashboardChartVisualizationYAxis
DashboardChartDashboardQuery
DashboardChartDashboardQueryInput
DashboardChartDashboardQueryInputRelativeTime
DashboardChartDashboardQueryInputTimeWindow
DashboardChartState
Input properties used for looking up and filtering DashboardChart resources.
DataAccessLabel
A DataAccessLabel is a label on events to define user access to data.
DataAccessLabelArgs
The set of arguments for DataAccessLabel.
The set of arguments for DataAccessLabel.
DataAccessLabelState
Input properties used for looking up and filtering DataAccessLabel resources.
DataAccessScope
A DataAccessScope is a boolean expression of data access labels used to restrict access to data for users.
DataAccessScopeAllowedDataAccessLabel
DataAccessScopeAllowedDataAccessLabelIngestionLabel
DataAccessScopeArgs
The set of arguments for DataAccessScope.
The set of arguments for DataAccessScope.
DataAccessScopeDeniedDataAccessLabel
DataAccessScopeDeniedDataAccessLabelIngestionLabel
DataAccessScopeState
Input properties used for looking up and filtering DataAccessScope resources.
DataExport
DataExport resource represents a request to export data from Chronicle to a GCS bucket.
DataExportArgs
The set of arguments for DataExport.
The set of arguments for DataExport.
DataExportDataExportStatus
DataExportIngestionLabel
DataExportState
Input properties used for looking up and filtering DataExport resources.
DataTable
Represents a Chronicle Data Table, a multicolumn structure used to ingest your own data into Google SecOps.
DataTableArgs
The set of arguments for DataTable.
The set of arguments for DataTable.
DataTableColumnInfo
DataTableRow
Represents a single row in a data table.
DataTableRowArgs
The set of arguments for DataTableRow.
The set of arguments for DataTableRow.
DataTableRowState
Input properties used for looking up and filtering DataTableRow resources.
DataTableScopeInfo
DataTableState
Input properties used for looking up and filtering DataTable resources.
Environment
An environment is logical container for different networks or customers that are managed by the SOC or MSSP. This is useful for SOCs who provide services to several different networks, customers or business units within the organization. The Platform comes with a predefined environment named Default Environment.
EnvironmentArgs
The set of arguments for Environment.
The set of arguments for Environment.
EnvironmentGroup
Environment groups let you organize multiple environments into logical categories, making it easier to manage large organizations or multiple customers as a Managed Security Service Provider (MSSP).
EnvironmentGroupArgs
The set of arguments for EnvironmentGroup.
The set of arguments for EnvironmentGroup.
EnvironmentGroupState
Input properties used for looking up and filtering EnvironmentGroup resources.
EnvironmentState
Input properties used for looking up and filtering Environment resources.
Feed
The FeedsService is responsible for configuring and managing the ingestion of third-party security data and logs into Google Security Operations through various feed creation, updates, and lifecycle management, and schema validation.
FeedArgs
The set of arguments for Feed.
The set of arguments for Feed.
FeedDetails
FeedDetailsAmazonS3Settings
FeedDetailsAmazonS3SettingsAuthentication
FeedDetailsAmazonS3V2Settings
FeedDetailsAmazonS3V2SettingsAuthentication
FeedDetailsAmazonS3V2SettingsAuthenticationAccessKeySecretAuth
FeedDetailsAmazonS3V2SettingsAuthenticationAwsIamRoleAuth
FeedDetailsAmazonSqsSettings
FeedDetailsAmazonSqsSettingsAuthentication
FeedDetailsAmazonSqsSettingsAuthenticationAdditionalS3AccessKeySecretAuth
FeedDetailsAmazonSqsSettingsAuthenticationSqsAccessKeySecretAuth
FeedDetailsAmazonSqsV2Settings
FeedDetailsAmazonSqsV2SettingsAuthentication
FeedDetailsAmazonSqsV2SettingsAuthenticationAwsIamRoleAuth
FeedDetailsAmazonSqsV2SettingsAuthenticationSqsV2AccessKeySecretAuth
FeedDetailsAnomaliSettings
FeedDetailsAnomaliSettingsAuthentication
FeedDetailsAwsEc2HostsSettings
FeedDetailsAwsEc2HostsSettingsAuthentication
FeedDetailsAwsEc2InstancesSettings
FeedDetailsAwsEc2InstancesSettingsAuthentication
FeedDetailsAwsEc2VpcsSettings
FeedDetailsAwsEc2VpcsSettingsAuthentication
FeedDetailsAwsIamSettings
FeedDetailsAwsIamSettingsAuthentication
FeedDetailsAzureAdAuditSettings
FeedDetailsAzureAdAuditSettingsAuthentication
FeedDetailsAzureAdContextSettings
FeedDetailsAzureAdContextSettingsAuthentication
FeedDetailsAzureAdSettings
FeedDetailsAzureAdSettingsAuthentication
FeedDetailsAzureBlobStoreSettings
FeedDetailsAzureBlobStoreSettingsAuthentication
FeedDetailsAzureBlobStoreV2Settings
FeedDetailsAzureBlobStoreV2SettingsAuthentication
FeedDetailsAzureBlobStoreV2SettingsAuthenticationAzureV2WorkloadIdentityFederation
FeedDetailsAzureEventHubSettings
FeedDetailsAzureMdmIntuneSettings
FeedDetailsAzureMdmIntuneSettingsAuthentication
FeedDetailsCloudPassageSettings
FeedDetailsCloudPassageSettingsAuthentication
FeedDetailsCortexXdrSettings
FeedDetailsCortexXdrSettingsAuthentication
FeedDetailsCrowdstrikeAlertsSettings
FeedDetailsCrowdstrikeAlertsSettingsAuthentication
FeedDetailsCrowdstrikeDetectsSettings
FeedDetailsCrowdstrikeDetectsSettingsAuthentication
FeedDetailsDummyLogTypeSettings
FeedDetailsDummyLogTypeSettingsAuthentication
FeedDetailsDuoAuthSettings
FeedDetailsDuoAuthSettingsAuthentication
FeedDetailsDuoUserContextSettings
FeedDetailsDuoUserContextSettingsAuthentication
FeedDetailsFoxItStixSettings
FeedDetailsFoxItStixSettingsAuthentication
FeedDetailsFoxItStixSettingsSsl
FeedDetailsGcsSettings
FeedDetailsGcsV2Settings
FeedDetailsGoogleCloudIdentityDevicesSettings
FeedDetailsGoogleCloudIdentityDevicesSettingsAuthentication
FeedDetailsGoogleCloudIdentityDevicesSettingsAuthenticationClaims
FeedDetailsGoogleCloudIdentityDevicesSettingsAuthenticationRsCredentials
FeedDetailsGoogleCloudStorageEventDrivenSettings
FeedDetailsHttpSettings
FeedDetailsHttpsPushAmazonKinesisFirehoseSettings
FeedDetailsHttpsPushGoogleCloudPubsubSettings
FeedDetailsHttpsPushWebhookSettings
FeedDetailsImpervaWafSettings
FeedDetailsImpervaWafSettingsAuthentication
FeedDetailsMandiantIocSettings
FeedDetailsMandiantIocSettingsAuthentication
FeedDetailsMandiantIocSettingsAuthenticationHeaderKeyValue
FeedDetailsMicrosoftGraphAlertSettings
FeedDetailsMicrosoftGraphAlertSettingsAuthentication
FeedDetailsMicrosoftSecurityCenterAlertSettings
FeedDetailsMicrosoftSecurityCenterAlertSettingsAuthentication
FeedDetailsMimecastMailSettings
FeedDetailsMimecastMailSettingsAuthentication
FeedDetailsMimecastMailV2Settings
FeedDetailsMimecastMailV2SettingsAuthCredentials
FeedDetailsNetskopeAlertSettings
FeedDetailsNetskopeAlertSettingsAuthentication
FeedDetailsNetskopeAlertV2Settings
FeedDetailsNetskopeAlertV2SettingsAuthentication
FeedDetailsOffice365Settings
FeedDetailsOffice365SettingsAuthentication
FeedDetailsOktaSettings
FeedDetailsOktaSettingsAuthentication
FeedDetailsOktaUserContextSettings
FeedDetailsOktaUserContextSettingsAuthentication
FeedDetailsPanIocSettings
FeedDetailsPanIocSettingsAuthentication
FeedDetailsPanPrismaCloudSettings
FeedDetailsPanPrismaCloudSettingsAuthentication
FeedDetailsProofpointMailSettings
FeedDetailsProofpointMailSettingsAuthentication
FeedDetailsProofpointOnDemandSettings
FeedDetailsProofpointOnDemandSettingsAuthentication
FeedDetailsProofpointOnDemandSettingsAuthenticationHeaderKeyValue
FeedDetailsPubsubSettings
FeedDetailsQualysScanSettings
FeedDetailsQualysScanSettingsAuthentication
FeedDetailsQualysVmSettings
FeedDetailsQualysVmSettingsAuthentication
FeedDetailsRapid7InsightSettings
FeedDetailsRapid7InsightSettingsAuthentication
FeedDetailsRecordedFutureIocSettings
FeedDetailsRecordedFutureIocSettingsAuthentication
FeedDetailsRhIsacIocSettings
FeedDetailsRhIsacIocSettingsAuthentication
FeedDetailsSalesforceSettings
FeedDetailsSalesforceSettingsOauthJwtCredentials
FeedDetailsSalesforceSettingsOauthJwtCredentialsClaims
FeedDetailsSalesforceSettingsOauthJwtCredentialsRsCredentials
FeedDetailsSalesforceSettingsOauthPasswordGrantAuth
FeedDetailsSentineloneAlertSettings
FeedDetailsSentineloneAlertSettingsAuthentication
FeedDetailsServiceNowCmdbSettings
FeedDetailsServiceNowCmdbSettingsAuthentication
FeedDetailsSftpSettings
FeedDetailsSftpSettingsAuthentication
FeedDetailsSymantecEventExportSettings
FeedDetailsSymantecEventExportSettingsAuthentication
FeedDetailsThinkstCanarySettings
FeedDetailsThinkstCanarySettingsAuthentication
FeedDetailsThreatConnectIocSettings
FeedDetailsThreatConnectIocSettingsAuthentication
FeedDetailsThreatConnectIocV3Settings
FeedDetailsThreatConnectIocV3SettingsAuthentication
FeedDetailsTrellixHxAlertsSettings
FeedDetailsTrellixHxAlertsSettingsAuthentication
FeedDetailsTrellixHxAlertsSettingsAuthenticationMsso
FeedDetailsTrellixHxAlertsSettingsAuthenticationTrellixIam
FeedDetailsTrellixHxBulkAcqsSettings
FeedDetailsTrellixHxBulkAcqsSettingsAuthentication
FeedDetailsTrellixHxBulkAcqsSettingsAuthenticationMsso
FeedDetailsTrellixHxBulkAcqsSettingsAuthenticationTrellixIam
FeedDetailsTrellixHxHostsSettings
FeedDetailsTrellixHxHostsSettingsAuthentication
FeedDetailsTrellixHxHostsSettingsAuthenticationMsso
FeedDetailsTrellixHxHostsSettingsAuthenticationTrellixIam
FeedDetailsWorkdaySettings
FeedDetailsWorkdaySettingsAuthentication
FeedDetailsWorkspaceActivitySettings
FeedDetailsWorkspaceActivitySettingsAuthentication
FeedDetailsWorkspaceActivitySettingsAuthenticationClaims
FeedDetailsWorkspaceActivitySettingsAuthenticationRsCredentials
FeedDetailsWorkspaceAlertsSettings
FeedDetailsWorkspaceAlertsSettingsAuthentication
FeedDetailsWorkspaceAlertsSettingsAuthenticationClaims
FeedDetailsWorkspaceAlertsSettingsAuthenticationRsCredentials
FeedDetailsWorkspaceChromeOsSettings
FeedDetailsWorkspaceChromeOsSettingsAuthentication
FeedDetailsWorkspaceChromeOsSettingsAuthenticationClaims
FeedDetailsWorkspaceChromeOsSettingsAuthenticationRsCredentials
FeedDetailsWorkspaceGroupsSettings
FeedDetailsWorkspaceGroupsSettingsAuthentication
FeedDetailsWorkspaceGroupsSettingsAuthenticationClaims
FeedDetailsWorkspaceGroupsSettingsAuthenticationRsCredentials
FeedDetailsWorkspaceMobileSettings
FeedDetailsWorkspaceMobileSettingsAuthentication
FeedDetailsWorkspaceMobileSettingsAuthenticationClaims
FeedDetailsWorkspaceMobileSettingsAuthenticationRsCredentials
FeedDetailsWorkspacePrivilegesSettings
FeedDetailsWorkspacePrivilegesSettingsAuthentication
FeedDetailsWorkspacePrivilegesSettingsAuthenticationClaims
FeedDetailsWorkspacePrivilegesSettingsAuthenticationRsCredentials
FeedFailureDetails
FeedState
Input properties used for looking up and filtering Feed resources.
FindingsRefinement
Represents a set of logic conditions used to refine various types of findings such as curated rule detections.
FindingsRefinementArgs
The set of arguments for FindingsRefinement.
The set of arguments for FindingsRefinement.
FindingsRefinementDeployment
The FindingsRefinementDeployment resource represents the deployment state of a findings refinement.
FindingsRefinementDeploymentArgs
The set of arguments for FindingsRefinementDeployment.
The set of arguments for FindingsRefinementDeployment.
FindingsRefinementDeploymentDetectionExclusionApplication
FindingsRefinementDeploymentState
Input properties used for looking up and filtering FindingsRefinementDeployment resources.
FindingsRefinementOutcomeFilter
FindingsRefinementState
Input properties used for looking up and filtering FindingsRefinement resources.
NativeDashboard
A configuration for a native dashboard within a Google SecOps (Chronicle) instance.
NativeDashboardArgs
The set of arguments for NativeDashboard.
The set of arguments for NativeDashboard.
NativeDashboardChart
NativeDashboardChartChartLayout
NativeDashboardFilter
NativeDashboardFilterFilterOperatorAndFieldValue
NativeDashboardState
Input properties used for looking up and filtering NativeDashboard resources.
Parser
A parser is a configuration that parses raw logs of a specific log type into Unified Data Model (UDM) events.
Chronicle supports both customer-created custom parsers and Google-provided prebuilt parsers.
ParserArgs
The set of arguments for Parser.
The set of arguments for Parser.
ParserChangelog
ParserChangelogEntry
ParserCreator
ParserExtension
A parser extension allows customers to extend or customize the behavior of an existing prebuilt or custom parser.
It enables extracting additional fields from raw logs without modifying the base parser.
ParserExtensionArgs
The set of arguments for ParserExtension.
The set of arguments for ParserExtension.
ParserExtensionDynamicParsing
ParserExtensionDynamicParsingOptedField
ParserExtensionState
Input properties used for looking up and filtering ParserExtension resources.
ParserLowCode
ParserState
Input properties used for looking up and filtering Parser resources.
ParserVersionInfo
ReferenceList
Reference lists are user-defined lists of values which users can use in multiple Rules.
ReferenceListArgs
The set of arguments for ReferenceList.
The set of arguments for ReferenceList.
ReferenceListEntry
ReferenceListScopeInfo
ReferenceListScopeInfoReferenceListScope
ReferenceListState
Input properties used for looking up and filtering ReferenceList resources.
Retrohunt
Retrohunt is an execution of a Rule over a time range in the past.
RetrohuntArgs
The set of arguments for Retrohunt.
The set of arguments for Retrohunt.
RetrohuntExecutionInterval
RetrohuntProcessInterval
RetrohuntState
Input properties used for looking up and filtering Retrohunt resources.
Rule
The Rule resource represents a user-created rule.
RuleArgs
The set of arguments for Rule.
The set of arguments for Rule.
RuleCompilationDiagnostic
RuleCompilationDiagnosticPosition
RuleDeployment
The RuleDeployment resource represents the deployment state of a Rule.
RuleDeploymentArgs
The set of arguments for RuleDeployment.
The set of arguments for RuleDeployment.
RuleDeploymentScheduleCustomizations
RuleDeploymentState
Input properties used for looking up and filtering RuleDeployment resources.
RuleSeverity
RuleState
Input properties used for looking up and filtering Rule resources.
SoarDomain
A SOAR domain designate a domain as internal, ensuring that entities associated with it are treated as organizational assets rather than external threats during ingestion.
SoarDomainArgs
The set of arguments for SoarDomain.
The set of arguments for SoarDomain.
SoarDomainState
Input properties used for looking up and filtering SoarDomain resources.
SoarNetwork
Manage networks in the platform using the Classless Inter-Domain Routing (CIDR) format. The system identifies network subnets to help Google Security Operations recognize internal assets and consider network sensitivity during playbook execution.
SoarNetworkArgs
The set of arguments for SoarNetwork.
The set of arguments for SoarNetwork.
SoarNetworkState
Input properties used for looking up and filtering SoarNetwork resources.
Watchlist
A watchlist is a list of entities that allows for bulk operations over the included entities.
WatchlistArgs
The set of arguments for Watchlist.
The set of arguments for Watchlist.
WatchlistEntityCount
WatchlistEntityPopulationMechanism
WatchlistState
Input properties used for looking up and filtering Watchlist resources.
WatchlistWatchlistUserPreferences
