Method: ruleExecutionErrors.list

Full name: projects.locations.instances.ruleExecutionErrors.list

Lists rule execution errors.

HTTP request

GET https://chronicle.googleapis.com/v1alpha/{parent}/ruleExecutionErrors

Path parameters

Parameters
parent

string

Required. The instance to list rule execution errors from. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
pageSize

integer

The maximum number of rule execution errors to return. The service may return fewer than this value. If unspecified, at most 1000 rule execution errors will be returned. The maximum value is 10000; values above 10000 will be coerced to 10000.
pageToken

string

A page token, received from a previous ListRuleExecutionErrors call. Provide this to retrieve the subsequent page.

When paginating, all other parameters provided to ListRuleExecutionErrors must match the call that provided the page token.
filter

string

A filter that can be used to retrieve specific rule execution errors. Only the following filters are allowed:

  rule = "{Rule.name}"
  curated_rule = "{CuratedRule.name}"

The value for rule or curated_rule must be a valid rule resource name or a valid curated rule resource name specified in quotes.

For 'rule', an optional 'revision_id' can be specified which can be used to fetch errors for a given revision of the rule. A '-' is also allowed to fetch errors across all revisions of the rule. If unspecified, only errors corresponding to the most recent revision of the rule will be returned. So these variations are all allowed:

  rule = "{Rule.name}"
  rule = "{Rule.name}@{Rule.revision_id}"
  rule = "{Rule.name}@-"

Revision IDs are not supported for curated rules.

Request body

The request body must be empty.

Response body

Response message for ListRuleExecutionErrors.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "rule_execution_errors": [
    {
      object (RuleExecutionError)
    }
  ],
  "next_page_token": string
}
Fields
rule_execution_errors[]

object (RuleExecutionError)

List of rule execution errors.
next_page_token

string

A token, which can be sent as page_token to retrieve the next page. If this field is omitted, there are no subsequent pages.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the parent resource:

  • chronicle.ruleExecutionErrors.list

For more information, see the IAM documentation.

RuleExecutionError

The RuleExecutionError resource represents an error generated from running/deploying a rule.

JSON representation 
{
  "name": string,
  "error": {
    object (Status)
  },
  "time_range": {
    object (Interval)
  },

  // Union field source can be only one of the following:
  "rule": string,
  "curated_rule": string
  // End of list of possible types for union field source.
}
Fields
name

string

Output only. The resource name of the rule execution error. Format: projects/{project}/locations/{location}/instances/{instance}/ruleExecutionErrors/{rule_execution_error}
error

object (Status)

Output only. The error status corresponding with the rule execution error.
time_range

object (Interval)

Output only. The event time range that the rule execution error corresponds with.
Union field source. The resource name of the source that generated the rule execution error. source can be only one of the following:
rule

string

Output only. The resource name of the rule that generated the rule execution error.
curated_rule

string

Output only. The resource name of the curated rule that generated the rule execution error.