Groups of UDM Events. Each group of UDM Events is associated with a single token or id in the request, and listed in the same order as tokens or ids in the request.
Groups of UDM Entities. Each group of UDM Entities is associated with a single token or id in the request, and listed in the same order as tokens or ids in the request.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[[["\u003cp\u003eThis API endpoint, \u003ccode\u003eprojects.locations.instances.legacy.legacyFindUdmEvents\u003c/code\u003e, is a legacy method for retrieving UDM and entity events using tokens or IDs.\u003c/p\u003e\n"],["\u003cp\u003eThe HTTP request is a \u003ccode\u003eGET\u003c/code\u003e method to \u003ccode\u003ehttps://chronicle.googleapis.com/v1alpha/{instance}/legacy:legacyFindUdmEvents\u003c/code\u003e, requiring an instance path parameter.\u003c/p\u003e\n"],["\u003cp\u003eYou can query using optional parameters such as \u003ccode\u003etokens[]\u003c/code\u003e, \u003ccode\u003eids[]\u003c/code\u003e, \u003ccode\u003ereturnUnenrichedData\u003c/code\u003e, and \u003ccode\u003ereturnAllEventsForLog\u003c/code\u003e, with tokens being disregarded if both tokens and ids are provided.\u003c/p\u003e\n"],["\u003cp\u003eThe response body contains an array of \u003ccode\u003eudm_event_groups\u003c/code\u003e and \u003ccode\u003eentity_groups\u003c/code\u003e, which represent UDM events and entity events, respectively, associated with the provided tokens or IDs.\u003c/p\u003e\n"],["\u003cp\u003eAccessing this endpoint requires the \u003ccode\u003echronicle.legacies.legacyFindUdmEvents\u003c/code\u003e IAM permission and the \u003ccode\u003ehttps://www.googleapis.com/auth/cloud-platform\u003c/code\u003e OAuth scope.\u003c/p\u003e\n"]]],[],null,["# Method: legacy.legacyFindUdmEvents\n\n- [HTTP request](#body.HTTP_TEMPLATE)\n- [Path parameters](#body.PATH_PARAMETERS)\n- [Query parameters](#body.QUERY_PARAMETERS)\n- [Request body](#body.request_body)\n- [Response body](#body.response_body)\n - [JSON representation](#body.LegacyFindUdmEventsResponse.SCHEMA_REPRESENTATION)\n- [Authorization scopes](#body.aspect)\n- [IAM Permissions](#body.aspect_1)\n- [UdmEventGroup](#UdmEventGroup)\n - [JSON representation](#UdmEventGroup.SCHEMA_REPRESENTATION)\n- [EntityGroup](#EntityGroup)\n - [JSON representation](#EntityGroup.SCHEMA_REPRESENTATION)\n- [Try it!](#try-it)\n\n**Full name**: projects.locations.instances.legacy.legacyFindUdmEvents\n\nLegacy endpoint for finding UDM/entity events using tokens or ids.\n\n### HTTP request\n\nChoose a location: \nafrica-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu \n\n\u003cbr /\u003e\n\n### Path parameters\n\n### Query parameters\n\n### Request body\n\nThe request body must be empty.\n\n### Response body\n\nAll UDM events or entity events for a given list of tokens or ids.\n\nIf successful, the response body contains data with the following structure:\n\n### Authorization scopes\n\nRequires the following OAuth scope:\n\n- `https://www.googleapis.com/auth/cloud-platform`\n\nFor more information, see the [Authentication Overview](/docs/authentication#authorization-gcp).\n\n### IAM Permissions\n\nRequires the following [IAM](https://cloud.google.com/iam/docs) permission on the `instance` resource:\n\n- `chronicle.legacies.legacyFindUdmEvents`\n\nFor more information, see the [IAM documentation](https://cloud.google.com/iam/docs).\n\nUdmEventGroup\n-------------\n\nAll UDM events associated with a token or id. There can be multiple events associated with a single token.\n\nEntityGroup\n-----------\n\nAll UDM entity events associated with a token or id."]]