Method: legacy.legacySearchRawLogsV2

• HTTP request
• Path parameters
• Query parameters
• Request body
• Response body
  • JSON representation
• Authorization scopes
• IAM Permissions
• Try it!

Full name: projects.locations.instances.legacy.legacySearchRawLogsV2

Searches for raw logs within a specified Google SecOps instance.

HTTP request

Choose a location:

africa-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-central2 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu

GET https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{name}/legacy:legacySearchRawLogsV2

Path parameters

Parameters
name	string Required. The Google SecOps instance to send the request to. Format: projects/{project}/locations/{location}/instances/{instance}

Query parameters

Parameters
query	string Required. The raw log query to search for. Example: raw = /.*/ logSource IN ["Okta"] parsed = true.
timeRange	object (Interval) Required. The time range to search within. This includes the start time and excludes the end time.
limit	integer Optional. The maximum number of results to return for the query. Any value over 10,000 is coerced to 10,000.

Request body

The request body must be empty.

Response body

Response of raw log search.

If successful, the response body contains data with the following structure:

JSON representation
{ "matches": [ { object (RawLogResult) } ] }

Fields
matches[]	object (RawLogResult) A list of the raw log results that match the query.

Authorization scopes

Requires the following OAuth scope:

• https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

• chronicle.events.searchRawLogs

For more information, see the IAM documentation.