REST Resource: projects.locations.instances.watchlists

Resource: Watchlist

A watchlist is a list of entities that allows for bulk operations over the included entities.

JSON representation 
{
  "name": string,
  "display_name": string,
  "description": string,
  "alert_risk_score_weight": number,
  "multiplying_factor": number,
  "entity_population_mechanism": {
    object (EntityPopulationMechanism)
  },
  "entity_count": {
    object (EntityCount)
  },
  "create_time": string,
  "update_time": string,
  "watchlist_user_preferences": {
    object (WatchlistUserPreferences)
  }
}
Fields
name

string

Identifier. Resource name of the watchlist. Format: projects/{project}/locations/{location}/instances/{instance}/watchlists/{watchlist}
display_name

string

Optional. Display name of the watchlist. Note that it must be less than 63 characters (https://google.aip.dev/148).
description

string

Optional. Description of the watchlist.
alert_risk_score_weight

number

Optional. Weight applied to the risk score of alerts for entities in this watchlist. The default is 1.0 if it is not specified.
multiplying_factor

number

Optional. Weight applied to the risk score for entities in this watchlist. The default is 1.0 if it is not specified.
entity_population_mechanism

object (EntityPopulationMechanism)

Required. Mechanism to populate entities in the watchlist.
entity_count

object (EntityCount)

Output only. Entity count in the watchlist.
create_time

string (Timestamp format)

Output only. Time the watchlist was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
update_time

string (Timestamp format)

Output only. Time the watchlist was last updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
watchlist_user_preferences

object (WatchlistUserPreferences)

Optional. User preferences for watchlist configuration.

EntityPopulationMechanism

Mechanism to populate entities in the watchlist.

JSON representation 
{

  // Union field mechanism can be only one of the following:
  "manual": {
    object (Manual)
  }
  // End of list of possible types for union field mechanism.
}
Fields
Union field mechanism. Ways to populate entities in watchlist. Currently, only manual is supported. mechanism can be only one of the following:
manual

object (Manual)

Optional. Entities are added manually.

Manual

This type has no fields.

Entities are added manually.

EntityCount

Count of different types of entities in the watchlist.

JSON representation 
{
  "user": integer,
  "asset": integer
}
Fields
user

integer

Output only. Count of user type entities in the watchlist.
asset

integer

Output only. Count of asset type entities in the watchlist.

WatchlistUserPreferences

A collection of user preferences for watchlist UI configuration.

JSON representation 
{
  "pinned": boolean,
  "risk_score_view": enum (RiskScoreView)
}
Fields
pinned

boolean

Optional. Whether the watchlist is pinned on the dashboard.
risk_score_view

enum (RiskScoreView)

Optional. What type of risk score to display for entity in watchlist. Note that the risk score view across all watchlists for the same user is the same. Therefore, new risk_score_view on one watchlist will be automatically applied to all watchlists for the same user.

RiskScoreView

Options for different types of risk scores to display.

Enums
RISK_SCORE_VIEW_UNSPECIFIED The default / unset value. The option will default to NORMALIZED.
RAW Show raw risk score.
NORMALIZED Show normalized risk score.

Methods

create

 Creates a watchlist for the given instance.

delete

 Deletes the watchlist for the given instance.

get

 Gets watchlist details for the given watchlist ID.

list

 Lists all watchlists for the given instance.

listEntities

 Lists all entities for the given watchlist.

patch

 Updates the watchlist for the given instance.