Method: instances.evaluateRuleCoverageLongRunning

Full name: projects.locations.instances.evaluateRuleCoverageLongRunning

Evaluates whether rules provide coverage for the input udms. Returns a long running operation.

HTTP request

POST https://{endpoint}/v1alpha/{instance}:evaluateRuleCoverageLongRunning

Where {endpoint} is one of the supported service endpoints.

Path parameters

Parameters
instance

string

Required. The Chronicle instance associated with the request. Format: projects/{project}/locations/{location}/instances/{instance}

Request body

The request body contains data with the following structure:

JSON representation 
{
  "threatDetectionOpportunityEvents": [
    {
      object (ThreatDetectionOpportunityEvents)
    }
  ],
  "excludeCompositeCoverage": boolean
}
Fields
threatDetectionOpportunityEvents[]

object (ThreatDetectionOpportunityEvents)

Required. The TDO events to evaluate rule coverage for.
excludeCompositeCoverage

boolean

Optional. Whether to exclude composite rules from the evaluation.

Response body

If successful, the response body contains an instance of Operation.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloud-platform
  • https://www.googleapis.com/auth/chronicle
  • https://www.googleapis.com/auth/chronicle.readonly

For more information, see the Authentication Overview.

ThreatDetectionOpportunityEvents

Threat Detection Opportunity events.

JSON representation 
{
  "threatDetectionOpportunityId": string,
  "udmsJson": [
    string
  ]
}
Fields
threatDetectionOpportunityId

string

Required. The id of the associated Threat Detection Opportunity.
udmsJson[]

string

Required. The input JSON UDM to evaluate all managed content rules against.