EnableLiveRule (V1) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V1 API (EnableLiveRule) to the modern Chronicle API (UpdateRuleDeployment).

Protocol and mapping overview

Feature Legacy API (EnableLiveRule V1) Modern Chronicle API (UpdateRuleDeployment)
HTTP method POST PATCH
Permissions Partner token or legacy API keys chronicle.googleapis.com/ruleDeployments.update

Request payload field-by-field parity

In the legacy V1 API, enabling live execution returned a long-running operation. In the modern Chronicle API, live running is configured synchronously by patching enabled = true and run_frequency = LIVE on RuleDeployment.

Legacy field (EnableLiveRuleRequest V1) Modern field (UpdateRuleDeploymentRequest / RuleDeployment) Field type Parity and migration notes
rule_id rule_deployment.name (in HTTP path) string Google Cloud scoping / resource unification: Legacy passed the raw rules engine parameter rule_id inside URL path. The modern API routes this using parent resource paths: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
— rule_deployment.enabled bool Target attribute mapping: Set enabled = true to activate continuous rule execution.
— rule_deployment.run_frequency enum Target attribute mapping: Set run_frequency = LIVE to configure streaming real-time detection. Rename to runFrequency in JSON.
— update_mask FieldMask Required mask: Include enabled,run_frequency in JSON updateMask.

Response payload field-by-field parity

While legacy backstory V1 returned a LRO google.longrunning.Operation tracking the activation job progress, the modern API returns the updated RuleDeployment synchronously.

Legacy field (google.longrunning.Operation V1) Modern field (RuleDeployment response) Field type Parity and migration notes
name (LRO name) name string Consolidated / replaced: Standard canonical resource path: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
metadata (EnableLiveRuleMetadata) — — Retired: Separate asynchronous activation metadata parameters are retired.
response (EnableLiveRuleResponse) enabled / run_frequency bool / enum Restructured: Returns the current runtime deployment settings directly (enabled = true and run_frequency = LIVE).

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under parent project instance folder bindings (rule_deployment.name path parameter).
  • Stateful attributes (enabled, run_frequency):
    • Rather than launching custom POST endpoints :enableLiveRule and spawning long-running operations, live execution is parameterized by setting enabled = true and run_frequency = LIVE inside the sub-resource RuleDeployment.
  • Synchronous scheduling:
    • Modern API applies updates synchronously, returning the resulting configuration instantly without needing operation polling.
  • Execution dependency on archive states:
    • Attempting to enable continuous execution fails if the rule deployment is archived (archived = true). The client must unarchive the rule first.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission check (chronicle.googleapis.com/ruleDeployments.update).