Method: legacy.legacyFindAssetEvents

Full name: projects.locations.instances.legacy.legacyFindAssetEvents

Legacy endpoint for getting events for an asset indicator.

HTTP request


Path parameters

Parameters
instance

string

Required. Chronicle instance this request is sent to. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
assetIndicator

object (AssetIndicator)

Required. The asset to return events for.
referenceTime

string (Timestamp format)

The time used to alias indicator and fetch results of the asset.

Uses RFC 3339, where generated output will always be Z-normalized and uses 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
timeRange

object (Interval)

Required. The time range of the events to return [inclusive start time, exclusive end time).
maxResults

integer

The maximum number of events to return. The service may return fewer than this value. If unspecified, at most 10,000 events will be returned. The maximum value is 250,000; values above that will be coerced to 250,000.

Request body

The request body must be empty.

Response body

Response message for legacy.legacyFindAssetEvents, containing all events related to an asset in a particular timeframe.

If successful, the response body contains data with the following structure:

JSON representation 
{
  "events": [
    {
      object (UDM)
    }
  ],
  "moreDataAvailable": boolean,
  "uri": [
    string
  ]
}
Fields
events[]

object (UDM)

A list of events, sorted in ascending order of timestamp.
moreDataAvailable

boolean

Indicates that more data was available but not sent due to more hits than maxResults.
uri[]

string

URLs that direct into the Backstory UI.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the instance resource:

  • chronicle.legacies.legacyFindAssetEvents

For more information, see the IAM documentation.