Method: legacyCases.addEvidence

• HTTP request
• Path parameters
• Request body
  • JSON representation
• Response body
  • JSON representation
• Authorization scopes
• IAM Permissions
• CaseCommentV2
  • JSON representation
• EvidenceType
• Try it!

Full name: projects.locations.instances.legacyCases.addEvidence

Adds an evidence (attachment) to a given case.

HTTP request

Choose a location:

africa-south1 asia-northeast1 asia-south1 asia-southeast1 asia-southeast2 australia-southeast1 europe-central2 europe-west12 europe-west2 europe-west3 europe-west6 europe-west9 me-central1 me-central2 me-west1 northamerica-northeast2 southamerica-east1 us eu

POST https://chronicle.africa-south1.rep.googleapis.com/v1alpha/{name}/legacyCases:addEvidence

Path parameters

Parameters
name	string Required. The evidence (attachment) of a given case. Format: projects/{project}/locations/{location}/instances/{instance}/legacyCases:addEvidence

Request body

The request body contains data with the following structure:

JSON representation
{ "caseId": string, "alertIdentifier": string, "base64Blob": string, "type": string, "description": string, "isImportant": boolean }

Fields
caseId	string (int64 format) Required. CaseId is the ID of the case associated for the action.
alertIdentifier	string
base64Blob	string
type	string
description	string
isImportant	boolean

Response body

Response message for legacyCases.addEvidence

If successful, the response body contains data with the following structure:

JSON representation
{ "name": string, "caseId": string, "creator": string, "type": string, "isImportant": boolean, "comment": string, "commentId": string, "description": string, "evidenceThumbnail": string, "sizeInKb": integer, "isFavorite": boolean, "caseCommentV2": { object (CaseCommentV2) }, "evidenceType": enum (EvidenceType) }

Fields
name	string
caseId	string (int64 format) Output only. CaseId is the ID of the case associated for the action.
creator	string
type	string
isImportant	boolean
comment	string
commentId	string (int64 format)
description	string
evidenceThumbnail	string
sizeInKb	integer
isFavorite	boolean
caseCommentV2	object (CaseCommentV2)
evidenceType	enum (EvidenceType)

Authorization scopes

Requires the following OAuth scope:

• https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

IAM Permissions

Requires the following IAM permission on the name resource:

• chronicle.cases.update

For more information, see the IAM documentation.

CaseCommentV2

JSON representation
{ "title": string, "comment": string, "isFromWorkflowActivity": boolean, "lastEditor": string, "isDeleted": boolean, "commentForClient": string, "modificationTimeUnixTimInMsForClient": string, "isFavorite": boolean }

Fields
title	string
comment	string
isFromWorkflowActivity	boolean
lastEditor	string
isDeleted	boolean
commentForClient	string
modificationTimeUnixTimInMsForClient	string (int64 format)
isFavorite	boolean

EvidenceType

Evidence Type

Enums
ATTACHMENT
DATA