REST Resource: projects.locations.instances.remediationPlans

Resource: RemediationPlan

Represents an AI-driven Remediation Plan for a specific alert or case.

JSON representation 
{
  "name": string,
  "alertName": string,
  "caseId": integer,
  "alertId": string,
  "siemAlertId": string,
  "agentSessionId": string,
  "state": enum (RemediationPlanState),
  "triggerType": enum (RemediationPlanTriggerType),
  "statusDetails": string,
  "agentClassifiedUseCase": string,
  "planData": {
    object
  },
  "planMetadata": {
    object
  },
  "createTime": string,
  "updateTime": string,
  "actions": [
    {
      object (RemediationAction)
    }
  ],
  "latestExecution": {
    object (RemediationPlanExecution)
  }
}
Fields
name

string

Identifier. Resource name of the remediation plan.
alertName

string

Optional. The name of the alert.
caseId

integer (uint32 format)

Optional. The Case identifier.
alertId

string

Optional. The Alert identifier.
siemAlertId

string

Optional. The SIEM Alert identifier.
agentSessionId

string

Optional. The context id of the REMa session.
state

enum (RemediationPlanState)

Output only. Current plan status.
triggerType

enum (RemediationPlanTriggerType)

Optional. How the plan was triggered.
statusDetails

string

Optional. Detailed status information (e.g., error logs).
agentClassifiedUseCase

string

Optional. The use cases classified by the agent (e.g. "Phishing", "Malware").
planData

object (Struct format)

Optional. Complete plan details presented in the UI (contains 'planning_summary', 'error', etc.).
planMetadata

object (Struct format)

Optional. Metadata about the plan, such as token usage.
createTime

string (Timestamp format)

Output only. Creation time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. Modification time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
actions[]

object (RemediationAction)

Optional. The actions defined/suggested for this remediation plan.
latestExecution

object (RemediationPlanExecution)

Output only. Reference to the most recent execution run for this remediation plan.

RemediationPlanState

The state Of the Renediation plan.

Enums
REMEDIATION_PLAN_STATE_UNSPECIFIED Unspecified status.
REMEDIATION_PLAN_STATE_INITIALIZED Set when initializing the remediation planning process.
REMEDIATION_PLAN_STATE_REQUESTED Set before calling the REMa planning service in the Python service.
REMEDIATION_PLAN_STATE_SUGGESTED Plan successfully generated and suggested by REMa.
REMEDIATION_PLAN_STATE_ERROR Execution or generation failed with an error.
REMEDIATION_PLAN_STATE_APPROVED Approved by SOC analyst / user.
REMEDIATION_PLAN_STATE_DECLINED Declined by SOC analyst / user.

RemediationPlanTriggerType

The trigger type of the Remediation plan.

Enums
REMEDIATION_PLAN_TRIGGER_TYPE_UNSPECIFIED Unspecified trigger type.
REMEDIATION_PLAN_TRIGGER_TYPE_AUTOMATIC Process was automatically kicked off by a detection, alert, or system event.
REMEDIATION_PLAN_TRIGGER_TYPE_MANUAL Process was initialized as a step within a defined Playbook.

RemediationPlanExecution

Represents a single execution instance of a Remediation Plan.

JSON representation 
{
  "remediationPlan": string,
  "state": enum (RemediationPlanExecutionState),
  "summaryStatus": enum (RemediationPlanExecutionSummaryState),
  "actionsCount": integer,
  "pendingActionCount": integer,
  "successActionsCount": integer,
  "failureActionsCount": integer,
  "summary": string,
  "additionalData": {
    object
  },
  "metadata": {
    object
  },
  "createTime": string,
  "updateTime": string
}
Fields
remediationPlan

string

Required. Foreign key referring to the associated RemediationPlan.
state

enum (RemediationPlanExecutionState)

Output only. Execution status of the overall plan.
summaryStatus

enum (RemediationPlanExecutionSummaryState)

Output only. Summary status of the plan.
actionsCount

integer

Output only. Performance counters for actions.
pendingActionCount

integer

Output only. Number of actions to execute.
successActionsCount

integer

Output only. Successful actions count.
failureActionsCount

integer

Output only. Failed actions count.
summary

string

Output only. Narrative execution summary.
additionalData

object (Struct format)

Optional. Additional unstructured data.
metadata

object (Struct format)

Optional. Metadata for the execution.
createTime

string (Timestamp format)

Output only. Creation time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. Update time.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".

RemediationPlanExecutionState

Models the 'RemediationPlanExecutions' database table.

Enums
REMEDIATION_PLAN_EXECUTION_STATE_UNSPECIFIED Unspecified status.
REMEDIATION_PLAN_EXECUTION_STATE_IN_PROGRESS plan execution started
REMEDIATION_PLAN_EXECUTION_STATE_EXECUTED All actions in the plan executed. see action's status for more information
REMEDIATION_PLAN_EXECUTION_STATE_REJECTED The execution request was rejected (e.g., status declined).
REMEDIATION_PLAN_EXECUTION_STATE_ERROR Plan execution failed with an error.

RemediationPlanExecutionSummaryState

Summary state of the Remediation Plan Execution.

Enums
REMEDIATION_PLAN_EXECUTION_SUMMARY_STATE_UNSPECIFIED Unspecified standard status.
REMEDIATION_PLAN_EXECUTION_SUMMARY_STATE_IN_PROGRESS plan execution started
REMEDIATION_PLAN_EXECUTION_SUMMARY_STATE_EXECUTED All actions in the plan executed. see action's status for more information
REMEDIATION_PLAN_EXECUTION_SUMMARY_STATE_REJECTED The execution request was rejected (e.g., status declined).
REMEDIATION_PLAN_EXECUTION_SUMMARY_STATE_ERROR Plan execution failed with an error.

Methods

execute

 Executes a suggested Remediation Plan.

generate

 Triggers Remediation agent and saves its output as a Remediation Plan.

get

 Retrieves a specific self-contained Remediation Plan.

list

 Lists Remediation Plans with optional filtering.

patch

 Updates a Remediation Plan.