alerts

Creates, updates, deletes, gets or lists an alerts resource.

Overview

Name	`alerts`
Type	Resource
Id	`google.threatintelligence.alerts`

Fields

The following fields are returned by SELECT queries:

get
list

Name	Datatype	Description
`name`	`string`	Identifier. Server generated name for the alert. format is projects/{project}/alerts/{alert}
`aiSummary`	`string`	Optional. AI summary of the alert.
`audit`	`object`	Output only. Audit information for the alert. (id: Audit)
`configurations`	`array`	Output only. The resource names of the Configurations bound to this alert. Format: projects/{project}/configurations/{configuration}
`detail`	`object`	Output only. Details object for the alert, not all alerts will have a details object. (id: AlertDetail)
`displayName`	`string`	Output only. A short title for the alert.
`duplicateOf`	`string`	Output only. alert name of the alert this alert is a duplicate of. Format: projects/{project}/alerts/{alert}
`duplicatedBy`	`array`	Output only. alert names of the alerts that are duplicates of this alert. Format: projects/{project}/alerts/{alert}
`etag`	`string`	Optional. If included when updating an alert, this should be set to the current etag of the alert. If the etags do not match, the update will be rejected and an ABORTED error will be returned.
`externalId`	`string`	Output only. External ID for the alert. This is used internally to provide protection against out of order updates.
`findingCount`	`string (int64)`	Output only. The number of findings associated with this alert.
`findings`	`array`	Output only. Findings that are covered by this alert.
`priorityAnalysis`	`object`	Output only. High-Precision Priority Analysis for the alert. (id: PriorityAnalysis)
`relevanceAnalysis`	`object`	Output only. High-Precision Relevance Analysis verdict for the alert. (id: RelevanceAnalysis)
`severityAnalysis`	`object`	Output only. High-Precision Severity Analysis for the alert. (id: SeverityAnalysis)
`state`	`string`	Output only. State of the alert. (STATE_UNSPECIFIED, NEW, READ, TRIAGED, ESCALATED, RESOLVED, DUPLICATE, FALSE_POSITIVE, NOT_ACTIONABLE, BENIGN, TRACKED_EXTERNALLY)

Name	Datatype	Description
`name`	`string`	Identifier. Server generated name for the alert. format is projects/{project}/alerts/{alert}
`aiSummary`	`string`	Optional. AI summary of the alert.
`audit`	`object`	Output only. Audit information for the alert. (id: Audit)
`configurations`	`array`	Output only. The resource names of the Configurations bound to this alert. Format: projects/{project}/configurations/{configuration}
`detail`	`object`	Output only. Details object for the alert, not all alerts will have a details object. (id: AlertDetail)
`displayName`	`string`	Output only. A short title for the alert.
`duplicateOf`	`string`	Output only. alert name of the alert this alert is a duplicate of. Format: projects/{project}/alerts/{alert}
`duplicatedBy`	`array`	Output only. alert names of the alerts that are duplicates of this alert. Format: projects/{project}/alerts/{alert}
`etag`	`string`	Optional. If included when updating an alert, this should be set to the current etag of the alert. If the etags do not match, the update will be rejected and an ABORTED error will be returned.
`externalId`	`string`	Output only. External ID for the alert. This is used internally to provide protection against out of order updates.
`findingCount`	`string (int64)`	Output only. The number of findings associated with this alert.
`findings`	`array`	Output only. Findings that are covered by this alert.
`priorityAnalysis`	`object`	Output only. High-Precision Priority Analysis for the alert. (id: PriorityAnalysis)
`relevanceAnalysis`	`object`	Output only. High-Precision Relevance Analysis verdict for the alert. (id: RelevanceAnalysis)
`severityAnalysis`	`object`	Output only. High-Precision Severity Analysis for the alert. (id: SeverityAnalysis)
`state`	`string`	Output only. State of the alert. (STATE_UNSPECIFIED, NEW, READ, TRIAGED, ESCALATED, RESOLVED, DUPLICATE, FALSE_POSITIVE, NOT_ACTIONABLE, BENIGN, TRACKED_EXTERNALLY)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get`	`select`	`projectsId`, `alertsId`		Get an alert by name.
`list`	`select`	`projectsId`	`filter`, `pageToken`, `pageSize`, `orderBy`	Get a list of alerts that meet the filter criteria.
`enumerate_facets`	`exec`	`projectsId`	`filter`	EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that value for each facet.
`resolve`	`exec`	`projectsId`, `alertsId`		Marks an alert to closed state - RESOLVED.
`benign`	`exec`	`projectsId`, `alertsId`		Marks an alert as benign - BENIGN.
`escalate`	`exec`	`projectsId`, `alertsId`		Marks an alert as escalated - ESCALATED.
`not_actionable`	`exec`	`projectsId`, `alertsId`		Marks an alert as not actionable - NOT_ACTIONABLE.
`false_positive`	`exec`	`projectsId`, `alertsId`		Marks an alert as a false positive - FALSE_POSITIVE.
`duplicate`	`exec`	`projectsId`, `alertsId`		Marks an alert as a duplicate of another alert. - DUPLICATE.
`triage`	`exec`	`projectsId`, `alertsId`		Marks an alert as triaged - TRIAGED.
`track_externally`	`exec`	`projectsId`, `alertsId`		Marks an alert as tracked externally - TRACKED_EXTERNALLY.
`read`	`exec`	`projectsId`, `alertsId`		Marks an alert as read - READ.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`alertsId`	`string`
`projectsId`	`string`
`filter`	`string`
`orderBy`	`string`
`pageSize`	`integer (int32)`
`pageToken`	`string`

`SELECT` examples

get
list

Get an alert by name.

SELECT
name,
aiSummary,
audit,
configurations,
detail,
displayName,
duplicateOf,
duplicatedBy,
etag,
externalId,
findingCount,
findings,
priorityAnalysis,
relevanceAnalysis,
severityAnalysis,
state
FROM google.threatintelligence.alerts
WHERE projectsId = '{{ projectsId }}' -- required
AND alertsId = '{{ alertsId }}' -- required
;

Get a list of alerts that meet the filter criteria.

SELECT
name,
aiSummary,
audit,
configurations,
detail,
displayName,
duplicateOf,
duplicatedBy,
etag,
externalId,
findingCount,
findings,
priorityAnalysis,
relevanceAnalysis,
severityAnalysis,
state
FROM google.threatintelligence.alerts
WHERE projectsId = '{{ projectsId }}' -- required
AND filter = '{{ filter }}'
AND pageToken = '{{ pageToken }}'
AND pageSize = '{{ pageSize }}'
AND orderBy = '{{ orderBy }}'
;

Lifecycle Methods

EnumerateAlertFacets returns the facets and the number of alerts that meet the filter criteria and have that value for each facet.

EXEC google.threatintelligence.alerts.enumerate_facets 
@projectsId='{{ projectsId }}' --required, 
@filter='{{ filter }}'
;

Marks an alert to closed state - RESOLVED.

EXEC google.threatintelligence.alerts.resolve 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as benign - BENIGN.

EXEC google.threatintelligence.alerts.benign 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as escalated - ESCALATED.

EXEC google.threatintelligence.alerts.escalate 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as not actionable - NOT_ACTIONABLE.

EXEC google.threatintelligence.alerts.not_actionable 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as a false positive - FALSE_POSITIVE.

EXEC google.threatintelligence.alerts.false_positive 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as a duplicate of another alert. - DUPLICATE.

EXEC google.threatintelligence.alerts.duplicate 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required 
@@json=
'{
"duplicateOf": "{{ duplicateOf }}"
}'
;

Marks an alert as triaged - TRIAGED.

EXEC google.threatintelligence.alerts.triage 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as tracked externally - TRACKED_EXTERNALLY.

EXEC google.threatintelligence.alerts.track_externally 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Marks an alert as read - READ.

EXEC google.threatintelligence.alerts.read 
@projectsId='{{ projectsId }}' --required, 
@alertsId='{{ alertsId }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

Lifecycle Methods​