GetRetrohunt parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine API (GetRetrohunt) to the modern Chronicle API (GetRetrohunt).

Protocol and mapping overview

Feature Legacy API (GetRetrohunt) Modern Chronicle API (GetRetrohunt)
HTTP Method GET GET
Permissions Partner token or legacy API keys chronicle.googleapis.com/retrohunts.get

Request payload field-by-field parity

The modern Chronicle API GetRetrohuntRequest identifies target execution resources using canonical Google Cloud resource paths rather than separate version and execution IDs.

Legacy Field (GetRetrohuntRequest) Modern Field (GetRetrohuntRequest) Field type Parity & Migration Notes
version_id / retrohunt_id name (in HTTP path) string GCP Scoping / Consolidated ID: Legacy passed {rule_id} (or {rule_id}@{version_ts}) in version_id and the execution ID in retrohunt_id. The modern API unifies these parameters into a single canonical Google Cloud resource path under name: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id@revision_id}/retrohunts/{retrohunt_id}.

Response payload field-by-field parity

Both APIs return the retrieved Retrohunt execution resource.

Legacy Field (Retrohunt response) Modern Field (Retrohunt message) Field type Parity & Migration Notes
retrohunt_id / rule_id / version_id name string Consolidated: Legacy separate identifier strings are unified into the canonical Google Cloud resource path under name: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id@revision_id}/retrohunts/{retrohunt_id}.
event_start_time process_interval.start_time Timestamp Mapped inside the process_interval object (Interval.start_time).
event_end_time process_interval.end_time Timestamp Mapped inside the process_interval object (Interval.end_time).
retrohunt_start_time execution_interval.start_time Timestamp Mapped inside the execution_interval object (Interval.start_time).
retrohunt_end_time execution_interval.end_time Timestamp Mapped inside the execution_interval object (Interval.end_time).
state state enum Parity Mapped / Value Enrichment: Maps directly to State enum (RUNNING, DONE, CANCELLED). The modern API adds support for FAILED (value 4) when execution fails.
progress_percentage progress_percentage float Parity Mapped: Percent progress towards completion (0.00 to 100.00). Rename to progressPercentage in JSON.

Key differences

  • Service Consolidation and Renaming:
    • Legacy retrohunt retrieval was housed under RulesEngineService with URL pattern /v2/detect/rules/{version_id}/retrohunts/{retrohunt_id}.
    • Modern Chronicle API consolidates this under RuleService (GetRetrohunt), using standard Google Cloud parent paths (projects/.../rules/{rule}/retrohunts/{retrohunt}).
  • Google Cloud Project Scoping and Canonical Names:
    • Scoped natively under parent project instance rule bindings. Separate rule, version, and retrohunt IDs are consolidated into standard Google Cloud canonical resource names.
  • Time Window Consolidation (Interval):
    • Standalone timestamp pairs for event ranges and execution durations on returned objects are structured into standard google.type.Interval objects (process_interval and execution_interval).
  • IAM Permissions:
    • Request validation maps to standard Cloud IAM permission check (chronicle.googleapis.com/retrohunts.get).