RunRule (V1) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V1 API (RunRule) to the modern Chronicle API (CreateRetrohunt).

Protocol and mapping overview

Feature Legacy API (RunRule V1) Modern Chronicle API (CreateRetrohunt)
HTTP method POST POST
Permissions Partner token or legacy API keys chronicle.googleapis.com/retrohunts.create

Request payload field-by-field parity

The modern Chronicle API CreateRetrohuntRequest standardizes execution into standard REST sub-resource creation under parent rules and groups event times into interval fields.

Legacy field (RunRuleRequest V1) Modern field (CreateRetrohuntRequest / Retrohunt) Field type Parity and migration notes
— parent (in HTTP path) string Google Cloud scoping / architectural shift: Legacy identified rules using the raw parameter rule_id inside URL path. The modern API routes this using parent resource paths: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id} (where you target the rule UUID).
rule_id — — Ignored: Target rule ID is parsed directly from parent path segments.
event_start_time retrohunt.process_interval.start_time Timestamp Consolidated into interval: Legacy event_start_time is mapped inside the required process_interval interval object (Interval.start_time). Rename to processInterval.startTime in JSON.
event_end_time retrohunt.process_interval.end_time Timestamp Consolidated into interval: Legacy event_end_time is mapped inside the required process_interval interval object (Interval.end_time). Rename to processInterval.endTime in JSON.

Response payload field-by-field parity

Both APIs return a google.longrunning.Operation tracking the asynchronous execution job progress.

Legacy field (google.longrunning.Operation V1) Modern field (google.longrunning.Operation response) Field type Parity and migration notes
name (LRO name) name string Google Cloud scoping: Standard canonical resource name of the LRO Operation.
metadata (RunRuleMetadata) metadata (RetrohuntMetadata / Retrohunt) Message Restructured: The modern LRO operation returns progress metadata that resolves to the modern Retrohunt execution resource object. Field mappings between RunRuleMetadata and modern properties are detailed in the following table.
response (RunRuleResponse) / empty response (Retrohunt) Message Restructured: Instead of returning an empty response block, the modern LRO resolves to the full Retrohunt resource showing final state.

Nested metadata / status field parity

The fields mapping inside individual RunRuleMetadata V1 and modern properties are detailed in the following table:

Legacy field (RunRuleMetadata V1) Modern field (Retrohunt message) Field type Parity and migration notes
rule_id name string Consolidated into the modern canonical resource path: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/retrohunts/{retrohunt_id}.
event_start_time process_interval.start_time Timestamp Mapped inside the process_interval object (Interval.start_time).
event_end_time process_interval.end_time Timestamp Mapped inside the process_interval object (Interval.end_time).
run_started_time execution_interval.start_time Timestamp Mapped inside the execution_interval object (Interval.start_time).
run_completed_time execution_interval.end_time Timestamp Mapped inside the execution_interval object (Interval.end_time).
— state enum New field: Execution status enum (RUNNING, DONE, CANCELLED, FAILED).
— progress_percentage float New field: Percent progress towards completion.

Key differences

  • Google Cloud project scoping and endpoint realignment:
    • Scoped natively under parent project instance folder bindings (parent path parameter). Maps legacy POST custom actions :run under RulesEngine to standard REST sub-resource creations (.../rules/{rule_id}/retrohunts) under RuleService.
  • Time window consolidation (Interval):
    • Standalone timestamp pairs for event ranges and execution durations are structured into standard google.type.Interval objects (process_interval and execution_interval).
  • Response enrichment:
    • Rather than returning an empty response value on operation resolution, the modern operation returns the complete state of the finished Retrohunt execution details.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission check (chronicle.googleapis.com/retrohunts.create).